Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server

<p>Posted by Ron E on Sep 03</p>*Description:*<br /> Payara Server contains a vulnerability in its Server-Side Includes (SSI)<br /> implementation that allows arbitrary operating system command execution via<br /> the #exec directive. The issue occurs because user-controlled SSI<br /> directives are passed directly to Runtime.exec() without validation,<br /> sanitization, or restriction. An attack