CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
Monthly
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Authenticated remote code execution in Craft CMS 5.10.13.2 allows any low-privilege Control Panel user to run operating-system commands as the PHP/web-server process by injecting Twig through the app/render-components action. The attack requires only basic CP access; a non-admin Team user with no optional permissions was shown to override an EntryType uiLabelFormat and trigger an Entry render that evaluates attacker-controlled Twig via renderObjectTemplate(). No public exploit identified at time of analysis, but the impact is severe because the render path is unsandboxed and can reach PHP functions such as system().
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Server-side template injection in the Kiteworks Core appliance allows an authenticated System Administrator to store a crafted system-notification template whose embedded template-engine expressions are evaluated when the notification is next rendered, resulting in operating-system command execution on the appliance. Exploitation requires a high-privileged admin account (CVSS vector PR:H, UI:N) and has a timing dependency because the payload only fires when the affected notification is triggered, making this a malicious-insider or compromised-admin scenario rather than a perimeter-reachable RCE. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-assigned CVSS 3.1 score of 7.2 (C:H/I:H/A:H) reflects full compromise of confidentiality, integrity, and availability once the template is rendered.
Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute arbitrary commands on the underlying host by hiding server-side template syntax inside the filename of a multipart file upload. The crafted filename closes the template quoting context and injects an exec macro, which bypasses the dispatcher's authorization check, so no credentials or user interaction are required (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 10.0). Publicly available exploit code exists and an advisory with a proof-of-concept walkthrough is referenced by VulnCheck, but no KEV entry was provided, so this is not confirmed as actively exploited; the practical limiting factor is whether the multipart upload endpoint is reachable from the attacker's network.
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Remote code execution in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 lets any authenticated non-administrator user - Control Panel access is not required - run arbitrary operating-system commands as the web-server user. Craft signs the attacker-controlled license-shun cookie with the same key and format it uses to validate signed redirect parameters (the signature is not bound to its purpose), so the attacker can transplant that signed envelope into the login redirect parameter; on a successful login Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and reaches PHP system(). Exploitation requires a password-authenticated account without active 2FA, the default request configuration, and a callable PHP system(); there is no public exploit code identified at time of analysis, and the flaw is fixed in 4.18.6 and 5.10.13. The high severity score reflects full confidentiality, integrity, and availability impact at the application level once the preconditions are met.
Server-side template injection in Polyaxon through 2.16.4 lets any user who can submit a run execute arbitrary operating-system commands in the scheduler process by embedding Jinja2 payloads in spec fields such as queue, namespace, conditions, presets, or dependencies. Because the scheduler renders those fields with an unsandboxed Jinja2 environment, a low-privileged authenticated tenant can reach database credentials and service tokens held by the scheduler, turning a normal ML experiment submission into host-level code execution (CWE-1336, CVSS 4.0 base 8.7). No public exploit code or CISA KEV entry was identified at time of analysis, but the attack requires only a valid low-privilege account and no user interaction.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. No public exploit has been identified at time of analysis, but the SSTI root cause and self-hosted Git-forge target make this a high-priority patch.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Authenticated remote code execution in Craft CMS 5.10.13.2 allows any low-privilege Control Panel user to run operating-system commands as the PHP/web-server process by injecting Twig through the app/render-components action. The attack requires only basic CP access; a non-admin Team user with no optional permissions was shown to override an EntryType uiLabelFormat and trigger an Entry render that evaluates attacker-controlled Twig via renderObjectTemplate(). No public exploit identified at time of analysis, but the impact is severe because the render path is unsandboxed and can reach PHP functions such as system().
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Server-side template injection in the Kiteworks Core appliance allows an authenticated System Administrator to store a crafted system-notification template whose embedded template-engine expressions are evaluated when the notification is next rendered, resulting in operating-system command execution on the appliance. Exploitation requires a high-privileged admin account (CVSS vector PR:H, UI:N) and has a timing dependency because the payload only fires when the affected notification is triggered, making this a malicious-insider or compromised-admin scenario rather than a perimeter-reachable RCE. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-assigned CVSS 3.1 score of 7.2 (C:H/I:H/A:H) reflects full compromise of confidentiality, integrity, and availability once the template is rendered.
Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute arbitrary commands on the underlying host by hiding server-side template syntax inside the filename of a multipart file upload. The crafted filename closes the template quoting context and injects an exec macro, which bypasses the dispatcher's authorization check, so no credentials or user interaction are required (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 10.0). Publicly available exploit code exists and an advisory with a proof-of-concept walkthrough is referenced by VulnCheck, but no KEV entry was provided, so this is not confirmed as actively exploited; the practical limiting factor is whether the multipart upload endpoint is reachable from the attacker's network.
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Remote code execution in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 lets any authenticated non-administrator user - Control Panel access is not required - run arbitrary operating-system commands as the web-server user. Craft signs the attacker-controlled license-shun cookie with the same key and format it uses to validate signed redirect parameters (the signature is not bound to its purpose), so the attacker can transplant that signed envelope into the login redirect parameter; on a successful login Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and reaches PHP system(). Exploitation requires a password-authenticated account without active 2FA, the default request configuration, and a callable PHP system(); there is no public exploit code identified at time of analysis, and the flaw is fixed in 4.18.6 and 5.10.13. The high severity score reflects full confidentiality, integrity, and availability impact at the application level once the preconditions are met.
Server-side template injection in Polyaxon through 2.16.4 lets any user who can submit a run execute arbitrary operating-system commands in the scheduler process by embedding Jinja2 payloads in spec fields such as queue, namespace, conditions, presets, or dependencies. Because the scheduler renders those fields with an unsandboxed Jinja2 environment, a low-privileged authenticated tenant can reach database credentials and service tokens held by the scheduler, turning a normal ML experiment submission into host-level code execution (CWE-1336, CVSS 4.0 base 8.7). No public exploit code or CISA KEV entry was identified at time of analysis, but the attack requires only a valid low-privilege account and no user interaction.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. No public exploit has been identified at time of analysis, but the SSTI root cause and self-hosted Git-forge target make this a high-priority patch.