Wizarr Server Critical Flaw Allows Remote Code Execution via Wizard Bundles

Wizarr, a user invitation and management system for media servers, contains a critical security vulnerability that allows authenticated users or administrators to execute arbitrary Python code. The National Vulnerability Database has assigned the issue CVE-2026-108264 and rated it with a CVSS score of 9.1, classifying it as critical.

The vulnerability exists in how the application processes Markdown content within wizard steps. According to the NVD record, versions of Wizarr prior to 2026.9.1 evaluate this Markdown using a non-sandboxed Jinja2 environment. This environment exposes application globals, creating a dangerous execution context. An attacker who has authenticated access and can create wizard steps, or an administrator who imports an untrusted bundle via the POST /settings/wizard/import endpoint, can inject malicious code. When a user or administrator accesses the stored step through the GET /wizard/{server}/{idx} route, the application renders the content and executes the injected Python code.

The NVD record identifies CWE-1336 as the underlying weakness. The malicious code execution is not limited to the application layer. Because the Jinja2 environment is not sandboxed, the executed code can interact with the operating system. This allows an attacker to run commands as the application user. The potential impact includes disclosing the Flask SECRET_KEY, accessing credentials for connected services, and reading or modifying the database. The vulnerability also enables stored cross-site scripting attacks. The NVD record notes that additional evaluation sinks were found in app/jinja_filters.py and app/services/wizard_widgets.py, expanding the attack surface for this specific flaw.

Context and Background

Wizarr is designed to manage user invitations and permissions for media server platforms such as Jellyfin, Plex, and Emby. The software relies on a wizard interface to guide users through setup and configuration tasks. These tasks often involve Markdown-formatted instructions or steps that are stored and rendered by the application.

The security failure stems from the use of Jinja2, a popular Python template engine, in a configuration that lacks proper sandboxing. While Jinja2 can be configured to safely render untrusted input, the Wizarr implementation prior to version 2026.9.1 allowed access to application globals. This misconfiguration transforms a template rendering feature into a remote code execution vector. The vulnerability is triggered during the rendering of stored data, meaning the malicious payload persists in the database until the page is viewed.

Who Is Affected

The vulnerability affects any deployment of Wizarr running a version older than 2026.9.1. The NVD record specifically lists "wizarrrr wizarr < 2026.9.1" as the affected software.

Two types of users are at risk. First, any authenticated user who has the permission to create wizard steps can exploit this flaw. Second, administrators are at risk if they import wizard bundles from untrusted sources. The import function, located at POST /settings/wizard/import, processes these bundles without sufficient sanitization before storing them. Once stored, the malicious bundle waits for the GET /wizard/{server}/{idx} endpoint to be accessed, at which point the code executes.

What should you do?

The vendor has released a fix for this vulnerability. The NVD record states that the issue is fixed in version 2026.9.1. Administrators should update their Wizarr installations to this version or later immediately.

Until the update is applied, administrators should restrict access to the wizard import functionality. Only trusted bundles should be imported. Additionally, review existing wizard steps for any unexpected or complex Markdown content that could contain hidden code. Monitor server logs for unusual Python execution or command-line activity originating from the Wizarr application user.