Alfresco Content Services vulnerabilities

2 known vulnerabilities in Alfresco Content Services from Hyland. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Alfresco Enterprise: Incorrect Authorization

  CVE-2026-26336Feb 19, 2026Hyland

  Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.

• 8.8 High severity

  Alfresco Content Services: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2023-49964Dec 11, 2023HylandEPSS 34.7%

  An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to