Which versions of Wirtualna Uczelnia are affected by CVE-2026-34906?

Wirtualna Uczelnia, an academic management platform used by educational institutions, contains a critical remote code execution vulnerability that could allow attackers to compromise student data and…

How to fix or mitigate CVE-2026-34906?

Within 24 hours: Identify all Wirtualna Uczelnia instances in production (affected versions through wu#2016.437.295#0#20260327_105545) and assess network exposure; disconnect affected systems from untrusted networks where operationally feasible. Within 7 days: Deploy Web Application Firewall rules to block Server-Side Template Injection patterns in the redirectUrl parameter; implement network access controls limiting connectivity to authorized institutional networks only. Within 30 days: Contact vendor for patch availability timeline; if no patch is expected within 60 days, initiate evaluation and migration planning to alternative academic management platforms.

Wirtualna Uczelnia CVE-2026-34906

Q: What is the CVSS score of CVE-2026-34906?

CVE-2026-34906 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-33902 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-06-02 CERT-PL

GHSA-4pqh-3f6p-63c5

RCE Ssti Wirtualna Uczelnia

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERT-PL) · only source for this CVE.

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 12:20 vuln.today

CVSS changed

Jun 02, 2026 - 10:22 NVD

9.3 (CRITICAL)

CVE Published

Jun 02, 2026 - 08:31 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell.

This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

AnalysisAI

Remote code execution in Wirtualna Uczelnia (versions up to wu#2016.437.295#0#20260327_105545) allows unauthenticated network attackers to execute arbitrary commands via Server-Side Template Injection in the redirectToUrl endpoint's redirectUrlParameter. The CVSS 4.0 base score of 9.3 reflects no authentication, no user interaction, and high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Disclosure originated from CERT-PL, indicating a vetted advisory channel for this Polish academic management product.

Technical ContextAI

Wirtualna Uczelnia is a Polish university/academic management web application produced by Simple S.A. (CPE: cpe:2.3:a:simple_sa:wirtualna_uczelnia). The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), meaning user-controlled input flows directly into a server-side template rendering context. When the redirectUrlParameter on the redirectToUrl endpoint receives attacker-supplied template syntax, the underlying template engine evaluates the expression instead of treating it as a literal string, enabling arbitrary expression evaluation and, ultimately, OS command execution under the application's runtime account.

RemediationAI

Patch status: patch availability is not explicitly stated in the provided data; the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-34906 should be consulted for the fixed build identifier, and customers should contact Simple S.A. directly via https://simple.com.pl/branze/edukacyjna/ for an updated build superseding wu#2016.437.295#0#20260327_105545. Pending vendor patch installation, restrict network exposure of the application - place it behind VPN or IP allow-listing so only the campus network can reach it (trade-off: breaks remote student access). As a targeted compensating control, deploy a WAF rule blocking template-syntax metacharacters (e.g., ${, {{, #{, <%) in the redirectUrlParameter query parameter on the redirectToUrl endpoint, recognizing this can be bypassed via encoding and may break legitimate URL redirects containing those characters. Monitor web access logs for anomalous values on that parameter and outbound connections from the application server that could indicate reverse-shell establishment.