Skip to main content

GBIF IPT EUVDEUVD-2026-61140

| CVE-2026-71880 HIGH
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
2026-08-18 mandiant-cve@google.com GHSA-xf73-gxc6-65vv
Ssti Code Injection
7.6
CVSS 4.0 · Vendor: google
Share

Severity by source

Vendor (google) PRIMARY
7.6 HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.8 MEDIUM

Network-reachable with low-privilege authentication required (PR:L) and high payload-crafting complexity (AC:H); no availability impact or scope change confirmed by description.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 18, 2026 - 19:04 EUVD
Analysis Generated
Aug 18, 2026 - 18:34 vuln.today
CVE Published
Aug 18, 2026 - 18:19 cve.org
HIGH 7.6

DescriptionCVE.org

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection

AnalysisAI

Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege IPT account
Delivery
Identify template engine injection point in user-controlled input
Exploit
Craft engine-specific SSTI payload
Execution
Submit payload to vulnerable IPT endpoint
Persist
Template engine evaluates injected expression server-side
Impact
Retrieve sensitive server-side files or internal application state
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session on the target GBIF IPT instance with at least low-privilege access (CVSS PR:L confirmed); anonymous or unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.6 reflects serious confidentiality and integrity risk to the vulnerable system (VC:H/VI:H), with no availability impact (VA:N) and no confirmed scope change to subsequent systems (SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker obtains or registers a low-privilege account on a publicly accessible GBIF IPT instance, then submits a crafted template expression (such as a Freemarker or Velocity payload) into a user-controlled field that is subsequently evaluated server-side. The template engine processes the injected directive and returns the contents of sensitive server-side files - such as database configuration files or application properties containing credentials - directly to the attacker. …
Remediation The primary remediation is to upgrade GBIF IPT to version 3.3.4 or later, which resolves the template injection vulnerability per the description boundary; administrators should confirm the release is available at https://github.com/gbif/ipt/issues/3118 and the Mandiant advisory at https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0016.md before applying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete audit of GBIF IPT deployments across your infrastructure to identify all systems running versions earlier than 3.3.4, document their network accessibility, and map authorized user populations. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ssti

View all
CVE-2024-23692 CRITICAL POC
9.8 May 31

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
CVE-2025-47916 CRITICAL POC
10.0 May 16

Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
CVE-2024-6386 CRITICAL POC
9.9 Aug 21

Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
CVE-2025-23211 CRITICAL POC
9.9 Jan 28

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
CVE-2024-32651 CRITICAL POC
10.0 Apr 26

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
CVE-2024-4040 CRITICAL POC
10.0 Apr 22

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
CVE-2026-15734 CRITICAL POC
9.8 Aug 06

Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
CVE-2024-24724 CRITICAL POC
9.8 Apr 03

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
CVE-2026-28496 CRITICAL POC
9.4 Jun 23

Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
CVE-2025-1040 HIGH POC
8.8 Mar 20

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
CVE-2026-69118 HIGH POC
8.7 Aug 10

Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directive
CVE-2023-6709 HIGH POC
8.8 Dec 12

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all
CVE-2024-23692 CRITICAL POC
9.8
CVE-2025-47916 CRITICAL POC
10.0
CVE-2025-49619 HIGH POC
8.5
CVE-2024-6386 CRITICAL POC
9.9
CVE-2025-69516 HIGH POC
8.8
CVE-2025-49136 CRITICAL POC
9.0
CVE-2025-53833 CRITICAL POC
10.0
CVE-2025-23211 CRITICAL POC
9.9

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

EUVD-2026-61140 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy