What is the CVSS score of CVE-2025-60355?

CVE-2025-60355 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2025-60355?

Yes, a public proof-of-concept exploit is available for CVE-2025-60355. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-60355?

Within 24 hours, verify whether OneBlog v2.3.9 or earlier is in use and if so, restrict access to template editing and administrative functions to only essential, trusted personnel (enforce least privilege and strong authentication). Within 7 days, review and apply any vendor-issued mitigations or configuration changes, such as disabling FreeMarker template execution for untrusted users or implementing additional access controls; monitor vendor channels for a patch. Within 30 days, if no patch is available, evaluate migrating to a supported version or alternative platform, and conduct a security assessment of the blog infrastructure to identify and remediate similar risks.

OneBlog CVE-2025-60355

CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2025-10-28 cve@mitre.org

Code Injection Ssti Oneblog

9.8

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach FreeMarker template input in OneBlog
Delivery

Inject malicious template expression
Exploit

FreeMarker evaluates expression server-side
Execution

Execute arbitrary Java code
Impact

Full host compromise

Vulnerability Assessment

Weakness	CWE CWE-1336 ASVS 5.0 V1 - Encoding and Sanitization Template injection prevention
Exploitation Conditions	Exploitation requires reaching an OneBlog feature that processes attacker-controlled FreeMarker template content (v2.3.9 and earlier); the exact feature/endpoint is not described in the available sources. The input CVSS vector asserts no authentication and no user interaction (PR:N/UI:N), but FreeMarker SSTI in blog platforms is typically reached via a template-management/admin function, so the no-authentication precondition is not confirmed by the evidence and limits realistic exploitation if template access is in fact gated behind login. Limiting factors: small deployment footprint of OneBlog, probable need for access to a template-editing capability, and a PoC that is unverified.
Impact	Signals are mixed. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes an unauthenticated, network-reachable flaw with full code-execution impact, and the vuln.today priority is 'act_now'. However, EPSS is only 0.53% (44th percentile), i.e. low modeled exploitation probability, and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation - the two signals conflict and point to a theoretically critical but not-yet-mass-exploited issue. The PR:N claim also warrants scrutiny: FreeMarker SSTI in a blog platform is normally reached through a template-management/editing feature that is an administrative function, which would imply authentication, but the available sources do not describe the trigger, so the unauthenticated claim cannot be confirmed from the evidence - verify with the vendor. The 'act_now' label is driven by the high CVSS and SSTI→RCE potential rather than by confirmed exploitation. Net: treat as high-priority to patch for exposed OneBlog instances, but the real-world footprint is small (niche product) and exploitation is unconfirmed, so this is high-severity-but-low-observed-activity rather than an in-progress incident.
Exploit ScenarioDerived	An attacker reaches an OneBlog endpoint that evaluates attacker-influenced FreeMarker template content and injects a template expression that FreeMarker resolves server-side, leading to Java code execution on the host. A public PoC reference exists (GitHub issue) but is not verified as working exploit code, and the exact injection point and whether prior authentication is required are not described in the available sources.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 28, 2026

Server-side template injection in OneBlog v2.3.9 and earlier lets an attacker who can supply FreeMarker template content have it evaluated on the server, which can escalate to remote code execution with full loss of confidentiality, integrity and availability. The published CVSS is 9.8 with a network vector claiming no privileges or user interaction (PR:N/UI:N), but the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, since template handling in a blog platform is normally reached through an administrative or template-editing function and the unauthenticated precondition is not confirmed by the available sources - the exact endpoint is not described. Exploitation status is limited: a public PoC reference exists (github.com/line2222/vuln/issues/4) but is not verified as working exploit code, EPSS is only 0.53% (44th percentile), and no CISA KEV entry is present, so active exploitation is not confirmed; the issue is nonetheless flagged act_now in vuln.today priority and is confirmed actively exploited status is absent, leaving mixed signals overall.

RemediationAI

No vendor-released patch identified at time of analysis: the two references supplied, https://github.com/line2222/vuln/issues/4 and https://vuldb.com/vuln/330326, contain no fixed version or upgrade release, so no exact fix version can be cited and operators should track the vendor project for an update. Until a fix exists, the actionable controls follow from the injection point itself. Restrict access to whatever OneBlog function accepts FreeMarker template content - in practice the administrative and template-editing surfaces - to trusted networks or a VPN, accepting that this breaks remote publishing workflows and any integrations that rely on those endpoints; disable or remove template-editing capability for non-essential accounts, with the trade-off that theming and custom layouts must then be changed out-of-band by trusted administrators; run OneBlog under a least-privilege service account and confine it so a template-evaluation escape cannot reach other data on the host, noting that this limits blast radius rather than preventing injection; and enable request logging or WAF rules alerting on FreeMarker directive syntax (${...}, <#...>) in submitted content, understanding that signature-based matching is bypassable and generates false positives on legitimate template authoring. Because the exact affected endpoint is not described in the available sources, these controls should be applied defensively across all OneBlog features that render user-supplied content until the vendor range is clarified; the presence of an unverified public PoC reference and an act_now priority argue against deferring these steps.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause class is CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), here realized through FreeMarker, the Java template engine that turns template text into executable Java expressions. When user-controllable strings are rendered as FreeMarker template source rather than passed in as data, the engine evaluates embedded expressions and directive calls, giving the attacker a path from template syntax to arbitrary method invocation and ultimately server-side code execution inside the application's JVM context. The affected package is identified by the wildcard CPE cpe:2.3:a:zhyd:oneblog:*:*:*:*:*:*:*:*, which matches all released OneBlog versions; the report scopes the flaw to v2.3.9 and before. The sources do not state which OneBlog feature accepts the attacker-controlled template content or how the injection point is reached, so the specific delivery vector, the required access level, and whether the FreeMarker evaluation is sandboxed remain unverified; the evidence also lists no fixed version and no patch commit.

Know when Oneblog gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

FreeMarker template injection typically requires access to a template-management feature, so PR:L rather than PR:N; SSTI yields code execution giving full C/I/A, though the exact trigger is not described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

Executive ViewAI

Why It Matters

OneBlog v2.3.9 contains a critical vulnerability that could allow an attacker with template-editing access to execute code on the server, compromising the confidentiality, integrity, and availability of the blog platform. This affects the organization's public-facing blog and potentially the underlying server infrastructure, requiring immediate leadership attention to secure administrative access and plan for a vendor fix.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; implement least privilege for template-editing access, enforce strong authentication for administrative functions, and consider disabling FreeMarker template evaluation for untrusted users if feasible.

Threat Intelligence Overview

EPSS Score

0.5%

Top 56% exploitable

Prevalence

Low

niche open-source Chinese Java blog platform, limited enterprise footprint

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.