Ssti
Monthly
Any authenticated control panel user in Craft CMS - regardless of privilege level - can escape the Twig sandbox through an element-search condition and use a boolean oracle to recover the site's GeneralConfig::securityKey character by character, then forge Craft's HMAC-signed parameters offline and reach unsandboxed View::renderObjectTemplate(), where Twig string-callable syntax invokes native PHP callables as the web server user. Default installations in the ranges 4.0.0 to before 4.18.9 and 5.0.0 to before 5.11.2 are affected; no non-default configuration is required and no user interaction is involved. The vendor-released fix is 4.18.9 (4.x) and 5.11.2 (5.x); exploitation is not confirmed in the wild and no EPSS or KEV signal was supplied, though the advisory documents a regression proof that invokes a harmless substr() callback rather than an OS command. The vulnerability is a genuine high-priority issue rather than a CVSS-inflated one, though the authentication prerequisite tempers it.
Server-side template injection in Drupal Webform (CWE-1336) allows code injection, with the independently assessed impact rated high for confidentiality, integrity, and availability. The independent assessment identifies Webform 0.0.0 through 6.2.11 and 6.3.0 as affected, with vendor-fixed releases 6.2.12 and 6.3.1. No public exploit was identified at the time of analysis and EPSS is low at 0.22%, but the vuln.today decision is act_now because of the high severity.
Header-driven URI resolution in Apache Camel's HTTP producer components causes message-supplied CamelHttpUri and CamelRestHttpUri values to be expanded through CamelContext.resolvePropertyPlaceholders() before use, so an attacker who can influence those headers turns a URI string into a configuration-evaluation context and can read OS environment variables, JVM system properties, every registered secret-backend PropertiesFunction (AWS, Azure, GCP, HashiCorp, IBM, CyberArk, Kubernetes) and even invoke no-argument methods on beans in the registry. The flaw affects Apache Camel 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 across camel-http, camel-http-common, camel-vertx-http, camel-undertow and camel-netty-http, and a plain static to(http://backend/api) route is enough to be exposed; no authentication is required where a route is reachable by untrusted senders (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, 8.2). Exploitation yields a high-confidentiality but limited-integrity impact, and while no public exploit code or CISA KEV entry exists at time of analysis, the preconditions are ordinary and the vendor has shipped fixes, so this warrants prioritised patching.
Unauthenticated remote code execution in WeRSS (we-mp-rss) through 1.5.3 allows any attacker who can reach the public GET /rss/{feed_id} endpoint to run arbitrary OS commands as the service account. The flaw is a server-side template injection (CWE-95) in the template parser: by supplying a non-built-in ext value together with a {{=expression}} template, an attacker uses object-subclass traversal to bypass the eval denylist and reach command execution, with no authentication, user interaction, or non-default configuration required. Reported CVSS is 9.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N) and our independent assessment confirms remote, unauthenticated exploitation with high confidentiality, integrity and availability impact, rating this a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code was identified at time of analysis, though a public technical writeup of the exploitation chain and a VulnCheck advisory are referenced.
Server-side template injection in Tianji (msgbyte/tianji) before version 1.31.29 allows an attacker who already holds workspace-administrator privileges to execute arbitrary JavaScript inside the Tianji Node.js process by storing a lodash evaluate block ('<% code %>') in a survey feedTemplate or a monitor notification template. Because formatString() in src/server/utils/template.ts leaves the default lodash evaluate pattern enabled, the planted payload is rendered - and runs - when any unauthenticated user submits a response to the public survey.submit endpoint, so no victim administrator interaction is required to trigger it. The result can be command execution, secret disclosure, data modification, or service disruption; the vendor rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the practical limiting factor is the workspace-admin prerequisite rather than any external exploitability. There is no public exploit identified at time of analysis and the issue is fixed in version 1.31.29.
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or modify a custom resource reconciled by an affected Ansible-based operator execute embedded Jinja2 expressions inside the operator pod, achieving remote code execution and escalating to the operator's service account. Because these operators typically hold cluster-wide RBAC, successful exploitation crosses a privilege boundary (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting components of Red Hat Ansible Automation Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, the Migration Toolkit for Applications/Containers/Virtualization, OpenShift Service Mesh 3 and related Red Hat OpenShift and OpenStack streams. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the high attack complexity reflects the prerequisite that the targeted operator must pass attacker-controllable CR spec values into Jinja2 templating without sanitization. This is a genuinely high-priority flaw rather than a CVSS-inflated one, but with an important authentication caveat: purely anonymous or read-only users cannot trigger it.
Server-side template injection in SolusVM 2 up to and including build 2.0.0-44576 lets a remote authenticated user run arbitrary code as root on the management node, so a single low-privileged panel account - a client, reseller, or sub-account on the hosting provider's instance - is enough to potentially take over the underlying virtualization infrastructure. Exploitation requires valid credentials (CVSS PR:L) and no user interaction (UI:N), which is the primary limiting factor and excludes fully anonymous attackers, but because the injected template reaches a code-execution sink running with root privileges the confidentiality, integrity, and availability impact is high across both the vulnerable component and dependent systems (CVSS 9.4). No public exploit identified at time of analysis and the flaw is not reported as confirmed actively exploited.
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improper neutralization of special elements used in a template engine (CWE-1336, server-side template injection). Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C), an attacker can reach the vulnerable template-processing surface over the network without credentials and without any victim interaction, and the scope change (S:C) indicates compromise can extend beyond the vulnerable component into the surrounding account or session context. The score is the maximum possible (10.0) and Adobe has published remediation guidance in APSB26-153; no public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is driven by severity and ease of reachability rather than observed attacks.
Authenticated attackers with a common operational role can exploit a server-side template injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. The vulnerability arises because user-controlled message fields are not validated before template rendering, allowing expressions to execute in an unrestricted context (CWE-1336). With a CVSS 4.0 score of 8.7, no public exploit has been identified at time of analysis, but the low privilege requirement makes this a credible priority for organizations running unpatched versions.
Remote code execution affects Craft CMS 5.10.2 up to but not including 5.10.14, where the Twig sandbox fails to block PHP callables passed to the 'has some' and 'has every' operators inside sandboxed system-message templates. Exploitation requires an authenticated control-panel account that has been granted the System Messages permission - a permission that can be delegated to non-admin users - after which the attacker can invoke two-argument functions such as passthru or system and execute code with the privileges of the web server user. Per current intelligence there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the permission gate is the main limiter, so deployments that reserve System Messages for trusted administrators face materially lower practical risk than multi-user or agency installations that delegate that permission broadly.
Server-side template injection in Wizarr before 2026.9.1 allows an authenticated user with privileges to create or edit wizard steps - or an administrator who imports an attacker-supplied wizard bundle - to execute arbitrary Python in the context of the application process. Because the stored step Markdown is compiled by the application's non-sandboxed Jinja2 environment with application globals exposed, successful exploitation can run operating-system commands as the application user, disclose the Flask SECRET_KEY, reach connected media-server service credentials and the database, and inject stored cross-site scripting into pages rendered at GET /wizard/{server}/{idx}. The issue is rated 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is fixed in 2026.9.1; no public exploit code was identified at the time of analysis, and the PR:H prerequisite narrows the realistic attacker population to trusted-but-malicious insiders or admins socially engineered into importing a hostile bundle.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Authenticated remote code execution in Craft CMS 5.10.13.2 allows any low-privilege Control Panel user to run operating-system commands as the PHP/web-server process by injecting Twig through the app/render-components action. The attack requires only basic CP access; a non-admin Team user with no optional permissions was shown to override an EntryType uiLabelFormat and trigger an Entry render that evaluates attacker-controlled Twig via renderObjectTemplate(). No public exploit identified at time of analysis, but the impact is severe because the render path is unsandboxed and can reach PHP functions such as system().
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Server-side template injection in the Kiteworks Core appliance allows an authenticated System Administrator to store a crafted system-notification template whose embedded template-engine expressions are evaluated when the notification is next rendered, resulting in operating-system command execution on the appliance. Exploitation requires a high-privileged admin account (CVSS vector PR:H, UI:N) and has a timing dependency because the payload only fires when the affected notification is triggered, making this a malicious-insider or compromised-admin scenario rather than a perimeter-reachable RCE. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-assigned CVSS 3.1 score of 7.2 (C:H/I:H/A:H) reflects full compromise of confidentiality, integrity, and availability once the template is rendered.
Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute arbitrary commands on the underlying host by hiding server-side template syntax inside the filename of a multipart file upload. The crafted filename closes the template quoting context and injects an exec macro, which bypasses the dispatcher's authorization check, so no credentials or user interaction are required (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 10.0). Publicly available exploit code exists and an advisory with a proof-of-concept walkthrough is referenced by VulnCheck, but no KEV entry was provided, so this is not confirmed as actively exploited; the practical limiting factor is whether the multipart upload endpoint is reachable from the attacker's network.
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Remote code execution in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 lets any authenticated non-administrator user - Control Panel access is not required - run arbitrary operating-system commands as the web-server user. Craft signs the attacker-controlled license-shun cookie with the same key and format it uses to validate signed redirect parameters (the signature is not bound to its purpose), so the attacker can transplant that signed envelope into the login redirect parameter; on a successful login Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and reaches PHP system(). Exploitation requires a password-authenticated account without active 2FA, the default request configuration, and a callable PHP system(); there is no public exploit code identified at time of analysis, and the flaw is fixed in 4.18.6 and 5.10.13. The high severity score reflects full confidentiality, integrity, and availability impact at the application level once the preconditions are met.
Server-side template injection in Polyaxon through 2.16.4 lets any user who can submit a run execute arbitrary operating-system commands in the scheduler process by embedding Jinja2 payloads in spec fields such as queue, namespace, conditions, presets, or dependencies. Because the scheduler renders those fields with an unsandboxed Jinja2 environment, a low-privileged authenticated tenant can reach database credentials and service tokens held by the scheduler, turning a normal ML experiment submission into host-level code execution (CWE-1336, CVSS 4.0 base 8.7). No public exploit code or CISA KEV entry was identified at time of analysis, but the attack requires only a valid low-privilege account and no user interaction.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. No public exploit has been identified at time of analysis, but the SSTI root cause and self-hosted Git-forge target make this a high-priority patch.
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user to execute arbitrary VQL queries at elevated server-level permissions. The daily backup feature - enabled by default - captures notebook cell content verbatim; when an administrator later restores the backup, that content is interpolated into a Go template without ACL enforcement, breaking the privilege boundary between analyst and server roles. No public exploit has been identified at time of analysis, but the chained attack path (plant payload, wait for restore) represents a credible insider or compromised-analyst escalation vector against DFIR infrastructure.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Sandbox method allow-list bypass in Twig versions 1.0.0 through 3.26.x allows untrusted template authors to invoke any public method on Twig\Markup subclass objects, completely circumventing the application-configured SecurityPolicy allowedMethods list. The root cause is that SecurityPolicy::checkMethodAllowed() unconditionally skips policy enforcement for any object that is an instance of Twig\Markup - and because the class is not declared final, subclasses inherit the bypass. Applications using Twig's sandbox mode that pass Markup-derived objects into sandboxed templates (a common pattern for marking HTML as safe) inadvertently expose the full public API of those subclasses to potentially untrusted template authors. Vendor-released patch: 3.27.0. No public exploit identified at time of analysis.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.
Unauthenticated remote code execution affects BerriAI litellm through version 1.82.4, where the /prompts/test endpoint renders the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment. Because no authentication is required and templates are evaluated server-side, an attacker can inject a Jinja2 payload that escapes into Python and runs arbitrary OS commands on the proxy host. No public exploit identified at time of analysis and the EPSS probability is low (0.25%), but the CVSS is 9.8 and a third-party technical write-up is referenced.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
Server-Side Template Injection in the Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 permits authenticated remote code execution on the host running PHP. Any account holding only api.access and api.pages.write permissions - typical content-editor roles - can embed a Twig payload in the header.form.process.email.body Email action parameter, publish the page, and trigger arbitrary OS command execution by submitting the associated form. No active exploitation has been confirmed by CISA KEV and no public exploit has been identified at time of analysis, but the low privilege bar and well-understood SSTI attack class make this a high-priority remediation target.
Remote code execution via server-side template injection (SSTI) in document-merge-service affects all versions before 9.1.0, exploitable by authenticated users with access to upload XLSX templates. The xltpl library processes XLSX templates through a non-sandboxed Jinja2 environment, allowing an attacker to embed Jinja2 expressions that execute arbitrary code server-side as the document-merge-server user (UID 901). No active exploitation (KEV) has been confirmed, but Jinja2 SSTI techniques are well-documented and HackTricks references are cited in the advisory, indicating the attack pattern is publicly known.
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitrary JavaScript when the generated zod schema module is imported. Because formatDefaultValue in packages/zod/src/index.ts emits a query-parameter default containing a ${...} expression or backtick directly into a module-level template literal without escaping, the payload runs in whatever environment loads the generated code — the developer workstation, CI pipeline, test runner, or the built application. Publicly available exploit code exists (SSVC: PoC) and the flaw is rated automatable with total technical impact; there is no public evidence of active exploitation.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Server-side template injection in the Form::Processor::Field::HtmlArea Perl module (versions 0.06 through 1.162360) lets a remote unauthenticated attacker inject Locale::Maketext bracket-notation templates through HTML::Tidy validation diagnostics. Because the default language handle enables _AUTO, unrecognized message keys are compiled as templates, so attacker-controlled attribute names/values in submitted markup become method-dispatch templates on the language handle - yielding unhandled exceptions, near-unbounded memory allocation, and, where the application's handle subclass defines side-effecting public methods, invocation of those methods with attacker-chosen arguments. Reported by CPANSec with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.40%, 33rd percentile).
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Server-side template injection in ERPNext's Process Statement of Accounts feature (versions prior to 15.118.0 and 16.29.0) lets an authenticated user with a common operational role inject Jinja template expressions into the subject, body, and pdf_name fields, which are rendered with unrestricted globals including frappe.utils, yielding arbitrary server-side code execution. Tagged RCE/SSTI (CWE-1336) and rated CVSS 9.9 with scope change; no public exploit identified at time of analysis, but the trivial exploitation path and low privilege requirement make this a high-priority patch.
Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directives or Twig-style filters into incident templates, which are interpreted and executed as arbitrary PHP by the server when incidents are rendered. Any account with permission to create or edit incident templates can run OS commands as the web server process, yielding full compromise of the hosting environment. A publicly available proof-of-concept has been confirmed by VulnCheck and the upstream GitHub issue; no active exploitation has been recorded in CISA KEV at time of analysis.
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injection payloads that execute arbitrary commands as root, giving full host compromise. Publicly available exploit code exists (Stuub's SSTI-to-Root-RCE PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.28% (20th percentile), indicating no evidence of widespread automated exploitation yet. The combination of a working PoC and root-level impact makes this a high-priority patch target for any internet-exposed WGDashboard instance.
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.
Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Authenticated remote code execution in Axway SecureTransport (all versions prior to 5.5-20260528, confirmed present in 5.5-20260326) allows an administrator to inject Java expressions into mail templates that are evaluated server-side when emails are rendered and sent, resulting in full host compromise. The flaw is a Server-Side Template Injection (CWE-1336) reported by Toreon and fixed by Axway; no public exploit identified at time of analysis, though a technical write-up and vendor advisory exist. Because exploitation requires admin privileges (CVSS 4.0 PR:H), risk is bounded to trusted or compromised administrative accounts despite the 9.4 severity.
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data exfiltration in Gitleaks before 8.30.1 lets an attacker who controls the report template read arbitrary host environment variables through non-hermetic Sprig functions (env, expandenv, getHostByName) and smuggle them out via attacker-triggered DNS lookups. Because Gitleaks runs in CI/CD with broad access to credentials, tokens, and API keys - including the very secrets it just discovered during a scan - a malicious template turns the scanner into an exfiltration channel. A detailed public write-up describing the technique and the fix exists; there is no CISA KEV listing, so this reflects a demonstrated technique rather than confirmed active exploitation.
Stored Server-Side Template Injection in YesWiki's Bazar module allows an authenticated administrator to plant arbitrary Twig expressions into form semantic template fields (`bn_sem_template`, `bn_sem_reverse_template`), which are persistently stored and later executed server-side when unauthenticated requests reach the public JSON-LD semantic endpoint. Published proof-of-concept in the GHSA advisory confirms full escalation from harmless template evaluation (`{{ 7 * 7 }}` → `49`) to interactive OS-level reverse shell. The fix is confirmed in YesWiki v4.6.6, a dedicated security release addressing 12 CVEs; no CISA KEV listing at time of analysis, but publicly available exploit code exists.
Server-side template injection in Formie, a forms plugin for Craft CMS 5 (verbb/formie 3.0.0-beta.1 through 3.1.26), allows unauthenticated attackers to inject Twig syntax through request-controlled inputs that Hidden fields use as dynamic default values. When a public form contains a Hidden field seeded from the User Agent, Referer, Current URL, a query parameter, or a cookie, the attacker-supplied value reaches Craft's Twig rendering layer and is evaluated server-side, potentially yielding information disclosure, application-state modification, or remote code execution. No public exploit identified at time of analysis, though the flaw is tagged RCE/SSTI and rated CVSS 9.8.
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arbitrary code and disclose sensitive information by injecting Twig expressions into template-rendering features. The unsandboxed Twig environment exposes the application's dependency injection container, turning any admin-accessible template surface into a full RCE primitive. No public exploit identified at time of analysis, but a related auth-bypass chain (GHSA-78x5-c8gw-8279) is documented by VulnCheck and could lower the practical privilege bar.
Server-side template injection in JTL Shop 5.2.0 through 5.7.1 allows remote unauthenticated attackers to inject Smarty template syntax via unsanitized user input, exposing sensitive server-side values like database credentials and encryption keys. On versions 5.4.0 through 5.7.1, the flaw escalates to remote code execution by abusing registered Smarty modifiers (unserialize, file_get_contents) to drop a webshell and execute commands as the web server user. Publicly available exploit code exists via the Sansec research writeup, though no public exploit identified at time of analysis in CISA KEV.
Twig sandbox bypass in Pimcore CMS/DXP 12.3.8 lets authenticated administrators escape the template sandbox by abusing empty checkMethodAllowed() and checkPropertyAllowed() implementations, enabling arbitrary method calls on internal PHP objects such as the DAO layer, Doctrine DBAL Connection, and PDO. Exploitation goes through a malicious Twig template injected via the DataObject ClassDefinition Layout\Text component and can lead to arbitrary file reads, arbitrary SQL execution, and potential remote code execution via PHP object gadget chains; the pimcore_* function wildcard broadens the bypass to every Pimcore Twig function. No public exploit identified at time of analysis, but VulnCheck has published an advisory describing the technique.
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. Publicly available exploit code exists per SSVC, and the SSVC framework rates this as automatable with total technical impact, though no CISA KEV listing has been confirmed.
Remote code execution in Jupyter Enterprise Gateway (fixed in v3.3.0) is possible because attacker-supplied KERNEL_XXX environment variables (e.g. KERNEL_POD_NAME, KERNEL_WORKING_DIR) sent to the /api/kernels endpoint are rendered through Jinja2 when building the Kubernetes pod manifest, enabling Server-Side Template Injection. Any client able to reach the gateway API can inject Jinja2 expressions to execute Python and OS commands inside the Enterprise Gateway pod, then steal its Kubernetes service account token to read secrets and schedule privileged/hostPath pods, escalating to full cluster compromise. Publicly available exploit code exists (working curl PoCs in the advisory); the flaw is not listed in CISA KEV and EPSS is low at 0.86%.
Remote code execution in Wirtualna Uczelnia (versions up to wu#2016.437.295#0#20260327_105545) allows unauthenticated network attackers to execute arbitrary commands via Server-Side Template Injection in the redirectToUrl endpoint's redirectUrlParameter. The CVSS 4.0 base score of 9.3 reflects no authentication, no user interaction, and high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Disclosure originated from CERT-PL, indicating a vetted advisory channel for this Polish academic management product.
Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.
Code execution in JetBrains IntelliJ IDEA prior to 2026.1 is achievable through server-side template injection (SSTI) in the built-in Copyright plugin, which lets an attacker embed executable template expressions into copyright profile configurations. Because the CVSS vector is local with required user interaction (AV:L/UI:R), exploitation hinges on a developer opening or importing a malicious project/profile that triggers the injected template, running with the victim's privileges. There is no public exploit identified at time of analysis and EPSS is 0.00%, consistent with the SSVC 'exploitation: none' assessment.
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. No public exploit identified at time of analysis, but the vendor security advisory describes the chain explicitly.
Server-Side Template Injection in Mautic's theme engine allows authenticated users with theme creation or upload permissions to execute arbitrary code on the host. Because the platform renders uploaded Twig templates without a sandbox or strict function allowlist, an attacker who already holds theme-management rights can pivot from administrative content control to full server compromise, including reads of restricted system files and configuration. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.
Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that persists across conversation turns and manipulates AI model behavior. The vulnerability achieves high integrity impact (CVSS 8.2) through stored prompt injection, enabling attackers to alter model responses, extract sensitive context, or bypass application logic without authentication. No active exploitation confirmed at time of analysis, but the network-accessible attack surface and low complexity make this a priority for applications processing user-generated conversational input.
Template injection in Rancher Local Path Provisioner allows Kubernetes cluster operators with ConfigMap edit permissions to escalate privileges to node-level root access. Attackers with write access to the local-path-config ConfigMap can inject malicious Pod templates that bypass security controls, creating privileged containers with full host filesystem access. This enables theft of ServiceAccount tokens from co-located pods, access to other tenants' persistent volume data, and arbitrary modification of host node files. Vendor-released patch: v0.0.36. CVSS 8.7 (High) reflects the high-privilege prerequisite (PR:H) but scope change to container escape (S:C). No public exploit identified at time of analysis, though exploitation is straightforward for authenticated cluster operators.
Server-Side Template Injection leading to Remote Code Execution affects the banks LLM prompt-templating library (versions <= 2.4.1), which renders Jinja2 templates through an unsandboxed jinja2.Environment(). Any application that passes attacker-controlled strings as the template argument to Prompt() lets an attacker traverse Python dunder attributes to import os and run arbitrary host commands. A working proof-of-concept exists (publicly available exploit code exists) demonstrating command execution and file writes; there is no evidence of active exploitation (EPSS 0.15%, not in CISA KEV).
Remote code execution in SEPPmail Secure Email Gateway versions before 15.0.4 allows unauthenticated attackers to execute arbitrary template expressions through a server-side template injection flaw in the GINA UI endpoint. The vulnerability requires no authentication and has low attack complexity, but depends on specific template plugin configurations (CVSS 4.0: 8.3 High with AT:P indicating present attack conditions). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available.
Server-side template injection in LiteLLM Proxy versions 1.80.5 through 1.83.6 allows authenticated users to execute arbitrary code via the POST /prompts/test endpoint. Any user with a valid proxy API key can submit malicious prompt templates that escape sandboxing and run commands in the proxy server process, exposing environment secrets like provider API keys and database credentials. This vulnerability affects deployments using LiteLLM as an AI gateway proxy server. No active exploitation confirmed (not in CISA KEV), but GitHub advisory and patch are publicly available, increasing exploit likelihood. CVSS 8.6 (High) with network attack vector and low complexity, though PR:L requirement limits exposure to authenticated attackers only.
Server-Side Template Injection in Kirby CMS (versions before 4.9.0 and 5.0.0-5.3.x) lets an authenticated Panel user achieve remote code execution and unauthorized read/write actions by planting malicious query templates in untrusted dynamic option sources. Affected sites are those using option fields (checkboxes, color, multiselect, select, radio, tags, toggles) or the Options package with values sourced from a query or API, where the double-resolution of dynamic values re-parses attacker-controlled strings such as {{ users.first.password }} or {{ page.delete }}. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but vendor-rated severity is high; SSVC technical impact is total.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization' capability to execute arbitrary JavaScript in the platform process context. Affecting all versions prior to 6.9.5, this vulnerability permits authenticated high-privilege users to achieve complete system compromise through unsafe EJS template rendering in safeEjs.ts. No public exploit code identified and EPSS score of 0.07% indicates low observed exploitation probability, but CVSS 9.1 Critical rating reflects the total technical impact once privileged access is obtained. Vendor patch released in version 6.9.5.
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code by crafting malicious Jinja2 templates that bypass sandbox validation. The vulnerability exists because the PART_NAME_FORMAT validator uses a sandboxed Jinja2 environment, but the actual rendering engine in part/helpers.py uses an unsandboxed environment, combined with a validation bypass via dummy Part instances with pk=None that behave differently during validation versus production execution. No public exploit code or active exploitation confirmed at time of analysis.
Host-side code execution in BentoML through 1.4.37 lets an unauthenticated attacker who convinces a victim to import and containerize a crafted bento run arbitrary Python on the victim’s machine. The malicious Jinja2 dockerfile template is embedded in the bento and rendered by an unsandboxed Environment during `bentoml containerize`, before Docker isolation applies; publicly available exploit code exists, and the vendor fixed the issue in 1.4.38. EPSS is 0.04% (13th percentile), but the interaction-gated attack has high confidentiality, integrity, and availability impact, and the priority label is act_now with SSVC recording PoC exploitation and total technical impact.
Server-side template injection in OpenOlat e-learning platform versions prior to 19.1.31, 20.1.18, and 20.2.5 enables authenticated users with Author role to execute arbitrary operating system commands via crafted Velocity directives in reminder email templates. Exploitation requires low-privilege authentication (PR:L) but is network-accessible (AV:N) with low complexity (AC:L), achieving full system compromise (C:H/I:H/A:H). The vulnerability leverages Java reflection through Velocity templates to instantiate ProcessBuilder and execute commands with Tomcat process privileges, often root in containerized environments. EPSS data not provided; no CISA KEV status confirmed; publicly available exploit code exists per GitHub security advisory disclosure.
Remote code execution in giskard-agents Python library (versions ≤0.3.3 and 1.0.x alpha) allows attackers to execute arbitrary system commands when user-controlled strings are passed to the ChatWorkflow.chat() method. The vulnerability stems from unsandboxed Jinja2 template rendering that enables class traversal exploitation via Python's object introspection. Patched in versions 0.3.4 (stable) and 1.0.2b1 (pre-release). Public exploit code exists demonstrating full RCE via Jinja2 object traversal to os.popen(). No active exploitation confirmed at time of analysis, though the straightforward attack vector and clear POC make this a critical priority for affected deployments.
Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance access to read and write arbitrary files as root on the host system through exploitation of pongo2 template processing. The vulnerability (scored CVSS 10.0 critical) stems from a bypassed chroot isolation mechanism that was intended to confine template operations to instance filesystems but instead permits unrestricted host filesystem access. No public exploit identified at time of analysis, though the vulnerability is tagged as Server-Side Template Injection (SSTI) with a GitHub security advisory published.
A security vulnerability in renders user-supplied template content (CVSS 8.5) that allows an authenticated user with access. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Remote code execution in OpenMetadata versions 1.5.0 through 1.11.3 is achievable by an authenticated administrator via Server-Side Template Injection in the FreeMarker email templating engine. The platform stores administrator-supplied email template content in its database and renders it without sandboxing controls, allowing FreeMarker directives to instantiate arbitrary Java classes and execute OS commands server-side. A detailed public proof-of-concept from FPT Cloud AppSec Research Team is available; no active exploitation is confirmed in CISA KEV at time of analysis.
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template engine's themeeditor.php. By crafting template conditional strings using PHP's alternative function call syntax, attackers bypass security filters and execute arbitrary PHP code on the server.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Template injection (CWE-1336) in the Drupal AI CKEditor module affects versions 0.0.0 through 1.4.3, allowing an authenticated Drupal user who can use the module's features to inject unneutralized template syntax that is later evaluated by a template engine, producing limited code injection. Successful exploitation requires the victim to interact with crafted content (CVSS PR:L/UI:R), and impact is confined to low confidentiality and integrity effects within the unchanged component scope. No public exploit code or active exploitation has been reported, and availability of an updated release (1.4.3) keeps priority at monitor level.
Server-side template injection in BottleCRM (Django-CRM) through 1.14.5 allows an authenticated member of an organization to have attacker-controlled text compiled as a Django template by the send_email Celery task, exposing the template rendering context and the Python modules loaded in the worker, or tying up the shared worker with nested loops. The flaw is reachable remotely without any victim interaction through POST /api/accounts/<id>/create_mail/ by supplying a crafted AccountEmail message_body, and it requires a valid account that belongs to the target organization (the CVSS vector specifies PR:L). Because the sink is django.template.Template() rather than Jinja2, the assessed impact is confined to tenant-scoped information disclosure and denial of service against the shared Celery worker, with no public exploit identified at time of analysis and no confirmed path to arbitrary code execution.
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty expressions into email templates, which execute with web process privileges when previewed or rendered. The vulnerability requires high-privilege back-office access, but successful exploitation enables arbitrary OS command execution and file read/write. No active exploitation has been confirmed and no public exploit code is currently identified.
Server-side template injection in Furion .NET Framework up to and including 4.9.9.95 allows an authenticated, low-privileged user to have attacker-supplied template expressions evaluated by the ViewEngine.RunCompile routine, potentially disclosing or tampering with data rendered through the view engine. The flaw is rated moderate (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:L) and is only reachable where a deployed application routes user-influenced content into RunCompile. Publicly available exploit code exists, and no CISA KEV entry confirms active exploitation.
Server-side template injection (SSTI) in formtools.org Form Tools up to and including version 3.1.1 allows an authenticated low-privilege user to inject template-engine metacharacters via the page_titles argument in Clients::updateClientSettingsTab, potentially causing limited information disclosure and modification within the application. Publicly available exploit code exists, but exploitation requires a valid low-privilege account and the assessed impact is capped at Low for confidentiality, integrity, and availability. The vendor was notified early through a GitHub issue but has not responded, and no patched version has been released.
Server-side template injection in the Email Template component of ThinkCMF up to 8.0.7 lets an authenticated administrator submit template content that the underlying template engine evaluates server-side, enabling data exposure or logic execution within the application's privileges. Exploitation requires a privileged session able to reach MailController::templatePut in cmf-api/src/admin/controller/MailController.php, so anonymous and low-privilege users cannot trigger it; publicly available exploit code exists (a GitHub write-up targeting ThinkCMF v8.0.1), but there is no indication of confirmed active exploitation in CISA KEV. No vendor patch has been issued because the vendor did not respond to the disclosure, and independent assessment rates this a genuinely low-priority finding despite the SSTI classification.
Server-side Twig template injection in Solspace Freeform 5.0.0 through 5.10.13 for Craft CMS 5.x lets unauthenticated attackers submit Twig expressions through public forms that are evaluated by Freeform's isolated Twig renderer when field values are rendered back into HTML attributes (the vendor fix excludes the value, name, and id attributes from rendering). Confirmed impact is limited to disclosure of PHP/core and Craft bootstrap constants such as PHP_VERSION, PHP_OS, CRAFT_BASE_PATH, and CRAFT_VENDOR_PATH, plus possible form rendering errors from malformed Twig; no access to Craft globals, getenv(), alias(), database or mailer credentials, security/license keys, arbitrary files, or code execution was demonstrated in testing. Publicly available exploit code exists in the form of one-line payloads published in the vendor's GitHub security advisory (e.g. {{ constant('PHP_VERSION') }}@example.com), but there is no evidence of confirmed active exploitation (not listed in CISA KEV); CVSS 5.3 and the advisory's isolated-sandbox findings indicate low severity.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Any authenticated control panel user in Craft CMS - regardless of privilege level - can escape the Twig sandbox through an element-search condition and use a boolean oracle to recover the site's GeneralConfig::securityKey character by character, then forge Craft's HMAC-signed parameters offline and reach unsandboxed View::renderObjectTemplate(), where Twig string-callable syntax invokes native PHP callables as the web server user. Default installations in the ranges 4.0.0 to before 4.18.9 and 5.0.0 to before 5.11.2 are affected; no non-default configuration is required and no user interaction is involved. The vendor-released fix is 4.18.9 (4.x) and 5.11.2 (5.x); exploitation is not confirmed in the wild and no EPSS or KEV signal was supplied, though the advisory documents a regression proof that invokes a harmless substr() callback rather than an OS command. The vulnerability is a genuine high-priority issue rather than a CVSS-inflated one, though the authentication prerequisite tempers it.
Server-side template injection in Drupal Webform (CWE-1336) allows code injection, with the independently assessed impact rated high for confidentiality, integrity, and availability. The independent assessment identifies Webform 0.0.0 through 6.2.11 and 6.3.0 as affected, with vendor-fixed releases 6.2.12 and 6.3.1. No public exploit was identified at the time of analysis and EPSS is low at 0.22%, but the vuln.today decision is act_now because of the high severity.
Header-driven URI resolution in Apache Camel's HTTP producer components causes message-supplied CamelHttpUri and CamelRestHttpUri values to be expanded through CamelContext.resolvePropertyPlaceholders() before use, so an attacker who can influence those headers turns a URI string into a configuration-evaluation context and can read OS environment variables, JVM system properties, every registered secret-backend PropertiesFunction (AWS, Azure, GCP, HashiCorp, IBM, CyberArk, Kubernetes) and even invoke no-argument methods on beans in the registry. The flaw affects Apache Camel 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 across camel-http, camel-http-common, camel-vertx-http, camel-undertow and camel-netty-http, and a plain static to(http://backend/api) route is enough to be exposed; no authentication is required where a route is reachable by untrusted senders (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, 8.2). Exploitation yields a high-confidentiality but limited-integrity impact, and while no public exploit code or CISA KEV entry exists at time of analysis, the preconditions are ordinary and the vendor has shipped fixes, so this warrants prioritised patching.
Unauthenticated remote code execution in WeRSS (we-mp-rss) through 1.5.3 allows any attacker who can reach the public GET /rss/{feed_id} endpoint to run arbitrary OS commands as the service account. The flaw is a server-side template injection (CWE-95) in the template parser: by supplying a non-built-in ext value together with a {{=expression}} template, an attacker uses object-subclass traversal to bypass the eval denylist and reach command execution, with no authentication, user interaction, or non-default configuration required. Reported CVSS is 9.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N) and our independent assessment confirms remote, unauthenticated exploitation with high confidentiality, integrity and availability impact, rating this a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code was identified at time of analysis, though a public technical writeup of the exploitation chain and a VulnCheck advisory are referenced.
Server-side template injection in Tianji (msgbyte/tianji) before version 1.31.29 allows an attacker who already holds workspace-administrator privileges to execute arbitrary JavaScript inside the Tianji Node.js process by storing a lodash evaluate block ('<% code %>') in a survey feedTemplate or a monitor notification template. Because formatString() in src/server/utils/template.ts leaves the default lodash evaluate pattern enabled, the planted payload is rendered - and runs - when any unauthenticated user submits a response to the public survey.submit endpoint, so no victim administrator interaction is required to trigger it. The result can be command execution, secret disclosure, data modification, or service disruption; the vendor rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the practical limiting factor is the workspace-admin prerequisite rather than any external exploitability. There is no public exploit identified at time of analysis and the issue is fixed in version 1.31.29.
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or modify a custom resource reconciled by an affected Ansible-based operator execute embedded Jinja2 expressions inside the operator pod, achieving remote code execution and escalating to the operator's service account. Because these operators typically hold cluster-wide RBAC, successful exploitation crosses a privilege boundary (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting components of Red Hat Ansible Automation Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, the Migration Toolkit for Applications/Containers/Virtualization, OpenShift Service Mesh 3 and related Red Hat OpenShift and OpenStack streams. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the high attack complexity reflects the prerequisite that the targeted operator must pass attacker-controllable CR spec values into Jinja2 templating without sanitization. This is a genuinely high-priority flaw rather than a CVSS-inflated one, but with an important authentication caveat: purely anonymous or read-only users cannot trigger it.
Server-side template injection in SolusVM 2 up to and including build 2.0.0-44576 lets a remote authenticated user run arbitrary code as root on the management node, so a single low-privileged panel account - a client, reseller, or sub-account on the hosting provider's instance - is enough to potentially take over the underlying virtualization infrastructure. Exploitation requires valid credentials (CVSS PR:L) and no user interaction (UI:N), which is the primary limiting factor and excludes fully anonymous attackers, but because the injected template reaches a code-execution sink running with root privileges the confidentiality, integrity, and availability impact is high across both the vulnerable component and dependent systems (CVSS 9.4). No public exploit identified at time of analysis and the flaw is not reported as confirmed actively exploited.
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improper neutralization of special elements used in a template engine (CWE-1336, server-side template injection). Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C), an attacker can reach the vulnerable template-processing surface over the network without credentials and without any victim interaction, and the scope change (S:C) indicates compromise can extend beyond the vulnerable component into the surrounding account or session context. The score is the maximum possible (10.0) and Adobe has published remediation guidance in APSB26-153; no public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is driven by severity and ease of reachability rather than observed attacks.
Authenticated attackers with a common operational role can exploit a server-side template injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. The vulnerability arises because user-controlled message fields are not validated before template rendering, allowing expressions to execute in an unrestricted context (CWE-1336). With a CVSS 4.0 score of 8.7, no public exploit has been identified at time of analysis, but the low privilege requirement makes this a credible priority for organizations running unpatched versions.
Remote code execution affects Craft CMS 5.10.2 up to but not including 5.10.14, where the Twig sandbox fails to block PHP callables passed to the 'has some' and 'has every' operators inside sandboxed system-message templates. Exploitation requires an authenticated control-panel account that has been granted the System Messages permission - a permission that can be delegated to non-admin users - after which the attacker can invoke two-argument functions such as passthru or system and execute code with the privileges of the web server user. Per current intelligence there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the permission gate is the main limiter, so deployments that reserve System Messages for trusted administrators face materially lower practical risk than multi-user or agency installations that delegate that permission broadly.
Server-side template injection in Wizarr before 2026.9.1 allows an authenticated user with privileges to create or edit wizard steps - or an administrator who imports an attacker-supplied wizard bundle - to execute arbitrary Python in the context of the application process. Because the stored step Markdown is compiled by the application's non-sandboxed Jinja2 environment with application globals exposed, successful exploitation can run operating-system commands as the application user, disclose the Flask SECRET_KEY, reach connected media-server service credentials and the database, and inject stored cross-site scripting into pages rendered at GET /wizard/{server}/{idx}. The issue is rated 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is fixed in 2026.9.1; no public exploit code was identified at the time of analysis, and the PR:H prerequisite narrows the realistic attacker population to trusted-but-malicious insiders or admins socially engineered into importing a hostile bundle.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Authenticated remote code execution in Craft CMS 5.10.13.2 allows any low-privilege Control Panel user to run operating-system commands as the PHP/web-server process by injecting Twig through the app/render-components action. The attack requires only basic CP access; a non-admin Team user with no optional permissions was shown to override an EntryType uiLabelFormat and trigger an Entry render that evaluates attacker-controlled Twig via renderObjectTemplate(). No public exploit identified at time of analysis, but the impact is severe because the render path is unsandboxed and can reach PHP functions such as system().
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Server-side template injection in the Kiteworks Core appliance allows an authenticated System Administrator to store a crafted system-notification template whose embedded template-engine expressions are evaluated when the notification is next rendered, resulting in operating-system command execution on the appliance. Exploitation requires a high-privileged admin account (CVSS vector PR:H, UI:N) and has a timing dependency because the payload only fires when the affected notification is triggered, making this a malicious-insider or compromised-admin scenario rather than a perimeter-reachable RCE. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-assigned CVSS 3.1 score of 7.2 (C:H/I:H/A:H) reflects full compromise of confidentiality, integrity, and availability once the template is rendered.
Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute arbitrary commands on the underlying host by hiding server-side template syntax inside the filename of a multipart file upload. The crafted filename closes the template quoting context and injects an exec macro, which bypasses the dispatcher's authorization check, so no credentials or user interaction are required (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 10.0). Publicly available exploit code exists and an advisory with a proof-of-concept walkthrough is referenced by VulnCheck, but no KEV entry was provided, so this is not confirmed as actively exploited; the practical limiting factor is whether the multipart upload endpoint is reachable from the attacker's network.
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Remote code execution in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 lets any authenticated non-administrator user - Control Panel access is not required - run arbitrary operating-system commands as the web-server user. Craft signs the attacker-controlled license-shun cookie with the same key and format it uses to validate signed redirect parameters (the signature is not bound to its purpose), so the attacker can transplant that signed envelope into the login redirect parameter; on a successful login Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and reaches PHP system(). Exploitation requires a password-authenticated account without active 2FA, the default request configuration, and a callable PHP system(); there is no public exploit code identified at time of analysis, and the flaw is fixed in 4.18.6 and 5.10.13. The high severity score reflects full confidentiality, integrity, and availability impact at the application level once the preconditions are met.
Server-side template injection in Polyaxon through 2.16.4 lets any user who can submit a run execute arbitrary operating-system commands in the scheduler process by embedding Jinja2 payloads in spec fields such as queue, namespace, conditions, presets, or dependencies. Because the scheduler renders those fields with an unsandboxed Jinja2 environment, a low-privileged authenticated tenant can reach database credentials and service tokens held by the scheduler, turning a normal ML experiment submission into host-level code execution (CWE-1336, CVSS 4.0 base 8.7). No public exploit code or CISA KEV entry was identified at time of analysis, but the attack requires only a valid low-privilege account and no user interaction.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. No public exploit has been identified at time of analysis, but the SSTI root cause and self-hosted Git-forge target make this a high-priority patch.
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user to execute arbitrary VQL queries at elevated server-level permissions. The daily backup feature - enabled by default - captures notebook cell content verbatim; when an administrator later restores the backup, that content is interpolated into a Go template without ACL enforcement, breaking the privilege boundary between analyst and server roles. No public exploit has been identified at time of analysis, but the chained attack path (plant payload, wait for restore) represents a credible insider or compromised-analyst escalation vector against DFIR infrastructure.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Sandbox method allow-list bypass in Twig versions 1.0.0 through 3.26.x allows untrusted template authors to invoke any public method on Twig\Markup subclass objects, completely circumventing the application-configured SecurityPolicy allowedMethods list. The root cause is that SecurityPolicy::checkMethodAllowed() unconditionally skips policy enforcement for any object that is an instance of Twig\Markup - and because the class is not declared final, subclasses inherit the bypass. Applications using Twig's sandbox mode that pass Markup-derived objects into sandboxed templates (a common pattern for marking HTML as safe) inadvertently expose the full public API of those subclasses to potentially untrusted template authors. Vendor-released patch: 3.27.0. No public exploit identified at time of analysis.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.
Unauthenticated remote code execution affects BerriAI litellm through version 1.82.4, where the /prompts/test endpoint renders the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment. Because no authentication is required and templates are evaluated server-side, an attacker can inject a Jinja2 payload that escapes into Python and runs arbitrary OS commands on the proxy host. No public exploit identified at time of analysis and the EPSS probability is low (0.25%), but the CVSS is 9.8 and a third-party technical write-up is referenced.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
Server-Side Template Injection in the Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 permits authenticated remote code execution on the host running PHP. Any account holding only api.access and api.pages.write permissions - typical content-editor roles - can embed a Twig payload in the header.form.process.email.body Email action parameter, publish the page, and trigger arbitrary OS command execution by submitting the associated form. No active exploitation has been confirmed by CISA KEV and no public exploit has been identified at time of analysis, but the low privilege bar and well-understood SSTI attack class make this a high-priority remediation target.
Remote code execution via server-side template injection (SSTI) in document-merge-service affects all versions before 9.1.0, exploitable by authenticated users with access to upload XLSX templates. The xltpl library processes XLSX templates through a non-sandboxed Jinja2 environment, allowing an attacker to embed Jinja2 expressions that execute arbitrary code server-side as the document-merge-server user (UID 901). No active exploitation (KEV) has been confirmed, but Jinja2 SSTI techniques are well-documented and HackTricks references are cited in the advisory, indicating the attack pattern is publicly known.
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitrary JavaScript when the generated zod schema module is imported. Because formatDefaultValue in packages/zod/src/index.ts emits a query-parameter default containing a ${...} expression or backtick directly into a module-level template literal without escaping, the payload runs in whatever environment loads the generated code — the developer workstation, CI pipeline, test runner, or the built application. Publicly available exploit code exists (SSVC: PoC) and the flaw is rated automatable with total technical impact; there is no public evidence of active exploitation.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Server-side template injection in the Form::Processor::Field::HtmlArea Perl module (versions 0.06 through 1.162360) lets a remote unauthenticated attacker inject Locale::Maketext bracket-notation templates through HTML::Tidy validation diagnostics. Because the default language handle enables _AUTO, unrecognized message keys are compiled as templates, so attacker-controlled attribute names/values in submitted markup become method-dispatch templates on the language handle - yielding unhandled exceptions, near-unbounded memory allocation, and, where the application's handle subclass defines side-effecting public methods, invocation of those methods with attacker-chosen arguments. Reported by CPANSec with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.40%, 33rd percentile).
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Server-side template injection in ERPNext's Process Statement of Accounts feature (versions prior to 15.118.0 and 16.29.0) lets an authenticated user with a common operational role inject Jinja template expressions into the subject, body, and pdf_name fields, which are rendered with unrestricted globals including frappe.utils, yielding arbitrary server-side code execution. Tagged RCE/SSTI (CWE-1336) and rated CVSS 9.9 with scope change; no public exploit identified at time of analysis, but the trivial exploitation path and low privilege requirement make this a high-priority patch.
Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directives or Twig-style filters into incident templates, which are interpreted and executed as arbitrary PHP by the server when incidents are rendered. Any account with permission to create or edit incident templates can run OS commands as the web server process, yielding full compromise of the hosting environment. A publicly available proof-of-concept has been confirmed by VulnCheck and the upstream GitHub issue; no active exploitation has been recorded in CISA KEV at time of analysis.
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injection payloads that execute arbitrary commands as root, giving full host compromise. Publicly available exploit code exists (Stuub's SSTI-to-Root-RCE PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.28% (20th percentile), indicating no evidence of widespread automated exploitation yet. The combination of a working PoC and root-level impact makes this a high-priority patch target for any internet-exposed WGDashboard instance.
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.
Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Authenticated remote code execution in Axway SecureTransport (all versions prior to 5.5-20260528, confirmed present in 5.5-20260326) allows an administrator to inject Java expressions into mail templates that are evaluated server-side when emails are rendered and sent, resulting in full host compromise. The flaw is a Server-Side Template Injection (CWE-1336) reported by Toreon and fixed by Axway; no public exploit identified at time of analysis, though a technical write-up and vendor advisory exist. Because exploitation requires admin privileges (CVSS 4.0 PR:H), risk is bounded to trusted or compromised administrative accounts despite the 9.4 severity.
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data exfiltration in Gitleaks before 8.30.1 lets an attacker who controls the report template read arbitrary host environment variables through non-hermetic Sprig functions (env, expandenv, getHostByName) and smuggle them out via attacker-triggered DNS lookups. Because Gitleaks runs in CI/CD with broad access to credentials, tokens, and API keys - including the very secrets it just discovered during a scan - a malicious template turns the scanner into an exfiltration channel. A detailed public write-up describing the technique and the fix exists; there is no CISA KEV listing, so this reflects a demonstrated technique rather than confirmed active exploitation.
Stored Server-Side Template Injection in YesWiki's Bazar module allows an authenticated administrator to plant arbitrary Twig expressions into form semantic template fields (`bn_sem_template`, `bn_sem_reverse_template`), which are persistently stored and later executed server-side when unauthenticated requests reach the public JSON-LD semantic endpoint. Published proof-of-concept in the GHSA advisory confirms full escalation from harmless template evaluation (`{{ 7 * 7 }}` → `49`) to interactive OS-level reverse shell. The fix is confirmed in YesWiki v4.6.6, a dedicated security release addressing 12 CVEs; no CISA KEV listing at time of analysis, but publicly available exploit code exists.
Server-side template injection in Formie, a forms plugin for Craft CMS 5 (verbb/formie 3.0.0-beta.1 through 3.1.26), allows unauthenticated attackers to inject Twig syntax through request-controlled inputs that Hidden fields use as dynamic default values. When a public form contains a Hidden field seeded from the User Agent, Referer, Current URL, a query parameter, or a cookie, the attacker-supplied value reaches Craft's Twig rendering layer and is evaluated server-side, potentially yielding information disclosure, application-state modification, or remote code execution. No public exploit identified at time of analysis, though the flaw is tagged RCE/SSTI and rated CVSS 9.8.
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arbitrary code and disclose sensitive information by injecting Twig expressions into template-rendering features. The unsandboxed Twig environment exposes the application's dependency injection container, turning any admin-accessible template surface into a full RCE primitive. No public exploit identified at time of analysis, but a related auth-bypass chain (GHSA-78x5-c8gw-8279) is documented by VulnCheck and could lower the practical privilege bar.
Server-side template injection in JTL Shop 5.2.0 through 5.7.1 allows remote unauthenticated attackers to inject Smarty template syntax via unsanitized user input, exposing sensitive server-side values like database credentials and encryption keys. On versions 5.4.0 through 5.7.1, the flaw escalates to remote code execution by abusing registered Smarty modifiers (unserialize, file_get_contents) to drop a webshell and execute commands as the web server user. Publicly available exploit code exists via the Sansec research writeup, though no public exploit identified at time of analysis in CISA KEV.
Twig sandbox bypass in Pimcore CMS/DXP 12.3.8 lets authenticated administrators escape the template sandbox by abusing empty checkMethodAllowed() and checkPropertyAllowed() implementations, enabling arbitrary method calls on internal PHP objects such as the DAO layer, Doctrine DBAL Connection, and PDO. Exploitation goes through a malicious Twig template injected via the DataObject ClassDefinition Layout\Text component and can lead to arbitrary file reads, arbitrary SQL execution, and potential remote code execution via PHP object gadget chains; the pimcore_* function wildcard broadens the bypass to every Pimcore Twig function. No public exploit identified at time of analysis, but VulnCheck has published an advisory describing the technique.
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. Publicly available exploit code exists per SSVC, and the SSVC framework rates this as automatable with total technical impact, though no CISA KEV listing has been confirmed.
Remote code execution in Jupyter Enterprise Gateway (fixed in v3.3.0) is possible because attacker-supplied KERNEL_XXX environment variables (e.g. KERNEL_POD_NAME, KERNEL_WORKING_DIR) sent to the /api/kernels endpoint are rendered through Jinja2 when building the Kubernetes pod manifest, enabling Server-Side Template Injection. Any client able to reach the gateway API can inject Jinja2 expressions to execute Python and OS commands inside the Enterprise Gateway pod, then steal its Kubernetes service account token to read secrets and schedule privileged/hostPath pods, escalating to full cluster compromise. Publicly available exploit code exists (working curl PoCs in the advisory); the flaw is not listed in CISA KEV and EPSS is low at 0.86%.
Remote code execution in Wirtualna Uczelnia (versions up to wu#2016.437.295#0#20260327_105545) allows unauthenticated network attackers to execute arbitrary commands via Server-Side Template Injection in the redirectToUrl endpoint's redirectUrlParameter. The CVSS 4.0 base score of 9.3 reflects no authentication, no user interaction, and high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Disclosure originated from CERT-PL, indicating a vetted advisory channel for this Polish academic management product.
Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.
Code execution in JetBrains IntelliJ IDEA prior to 2026.1 is achievable through server-side template injection (SSTI) in the built-in Copyright plugin, which lets an attacker embed executable template expressions into copyright profile configurations. Because the CVSS vector is local with required user interaction (AV:L/UI:R), exploitation hinges on a developer opening or importing a malicious project/profile that triggers the injected template, running with the victim's privileges. There is no public exploit identified at time of analysis and EPSS is 0.00%, consistent with the SSVC 'exploitation: none' assessment.
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. No public exploit identified at time of analysis, but the vendor security advisory describes the chain explicitly.
Server-Side Template Injection in Mautic's theme engine allows authenticated users with theme creation or upload permissions to execute arbitrary code on the host. Because the platform renders uploaded Twig templates without a sandbox or strict function allowlist, an attacker who already holds theme-management rights can pivot from administrative content control to full server compromise, including reads of restricted system files and configuration. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.
Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that persists across conversation turns and manipulates AI model behavior. The vulnerability achieves high integrity impact (CVSS 8.2) through stored prompt injection, enabling attackers to alter model responses, extract sensitive context, or bypass application logic without authentication. No active exploitation confirmed at time of analysis, but the network-accessible attack surface and low complexity make this a priority for applications processing user-generated conversational input.
Template injection in Rancher Local Path Provisioner allows Kubernetes cluster operators with ConfigMap edit permissions to escalate privileges to node-level root access. Attackers with write access to the local-path-config ConfigMap can inject malicious Pod templates that bypass security controls, creating privileged containers with full host filesystem access. This enables theft of ServiceAccount tokens from co-located pods, access to other tenants' persistent volume data, and arbitrary modification of host node files. Vendor-released patch: v0.0.36. CVSS 8.7 (High) reflects the high-privilege prerequisite (PR:H) but scope change to container escape (S:C). No public exploit identified at time of analysis, though exploitation is straightforward for authenticated cluster operators.
Server-Side Template Injection leading to Remote Code Execution affects the banks LLM prompt-templating library (versions <= 2.4.1), which renders Jinja2 templates through an unsandboxed jinja2.Environment(). Any application that passes attacker-controlled strings as the template argument to Prompt() lets an attacker traverse Python dunder attributes to import os and run arbitrary host commands. A working proof-of-concept exists (publicly available exploit code exists) demonstrating command execution and file writes; there is no evidence of active exploitation (EPSS 0.15%, not in CISA KEV).
Remote code execution in SEPPmail Secure Email Gateway versions before 15.0.4 allows unauthenticated attackers to execute arbitrary template expressions through a server-side template injection flaw in the GINA UI endpoint. The vulnerability requires no authentication and has low attack complexity, but depends on specific template plugin configurations (CVSS 4.0: 8.3 High with AT:P indicating present attack conditions). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available.
Server-side template injection in LiteLLM Proxy versions 1.80.5 through 1.83.6 allows authenticated users to execute arbitrary code via the POST /prompts/test endpoint. Any user with a valid proxy API key can submit malicious prompt templates that escape sandboxing and run commands in the proxy server process, exposing environment secrets like provider API keys and database credentials. This vulnerability affects deployments using LiteLLM as an AI gateway proxy server. No active exploitation confirmed (not in CISA KEV), but GitHub advisory and patch are publicly available, increasing exploit likelihood. CVSS 8.6 (High) with network attack vector and low complexity, though PR:L requirement limits exposure to authenticated attackers only.
Server-Side Template Injection in Kirby CMS (versions before 4.9.0 and 5.0.0-5.3.x) lets an authenticated Panel user achieve remote code execution and unauthorized read/write actions by planting malicious query templates in untrusted dynamic option sources. Affected sites are those using option fields (checkboxes, color, multiselect, select, radio, tags, toggles) or the Options package with values sourced from a query or API, where the double-resolution of dynamic values re-parses attacker-controlled strings such as {{ users.first.password }} or {{ page.delete }}. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but vendor-rated severity is high; SSVC technical impact is total.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization' capability to execute arbitrary JavaScript in the platform process context. Affecting all versions prior to 6.9.5, this vulnerability permits authenticated high-privilege users to achieve complete system compromise through unsafe EJS template rendering in safeEjs.ts. No public exploit code identified and EPSS score of 0.07% indicates low observed exploitation probability, but CVSS 9.1 Critical rating reflects the total technical impact once privileged access is obtained. Vendor patch released in version 6.9.5.
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code by crafting malicious Jinja2 templates that bypass sandbox validation. The vulnerability exists because the PART_NAME_FORMAT validator uses a sandboxed Jinja2 environment, but the actual rendering engine in part/helpers.py uses an unsandboxed environment, combined with a validation bypass via dummy Part instances with pk=None that behave differently during validation versus production execution. No public exploit code or active exploitation confirmed at time of analysis.
Host-side code execution in BentoML through 1.4.37 lets an unauthenticated attacker who convinces a victim to import and containerize a crafted bento run arbitrary Python on the victim’s machine. The malicious Jinja2 dockerfile template is embedded in the bento and rendered by an unsandboxed Environment during `bentoml containerize`, before Docker isolation applies; publicly available exploit code exists, and the vendor fixed the issue in 1.4.38. EPSS is 0.04% (13th percentile), but the interaction-gated attack has high confidentiality, integrity, and availability impact, and the priority label is act_now with SSVC recording PoC exploitation and total technical impact.
Server-side template injection in OpenOlat e-learning platform versions prior to 19.1.31, 20.1.18, and 20.2.5 enables authenticated users with Author role to execute arbitrary operating system commands via crafted Velocity directives in reminder email templates. Exploitation requires low-privilege authentication (PR:L) but is network-accessible (AV:N) with low complexity (AC:L), achieving full system compromise (C:H/I:H/A:H). The vulnerability leverages Java reflection through Velocity templates to instantiate ProcessBuilder and execute commands with Tomcat process privileges, often root in containerized environments. EPSS data not provided; no CISA KEV status confirmed; publicly available exploit code exists per GitHub security advisory disclosure.
Remote code execution in giskard-agents Python library (versions ≤0.3.3 and 1.0.x alpha) allows attackers to execute arbitrary system commands when user-controlled strings are passed to the ChatWorkflow.chat() method. The vulnerability stems from unsandboxed Jinja2 template rendering that enables class traversal exploitation via Python's object introspection. Patched in versions 0.3.4 (stable) and 1.0.2b1 (pre-release). Public exploit code exists demonstrating full RCE via Jinja2 object traversal to os.popen(). No active exploitation confirmed at time of analysis, though the straightforward attack vector and clear POC make this a critical priority for affected deployments.
Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance access to read and write arbitrary files as root on the host system through exploitation of pongo2 template processing. The vulnerability (scored CVSS 10.0 critical) stems from a bypassed chroot isolation mechanism that was intended to confine template operations to instance filesystems but instead permits unrestricted host filesystem access. No public exploit identified at time of analysis, though the vulnerability is tagged as Server-Side Template Injection (SSTI) with a GitHub security advisory published.
A security vulnerability in renders user-supplied template content (CVSS 8.5) that allows an authenticated user with access. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Remote code execution in OpenMetadata versions 1.5.0 through 1.11.3 is achievable by an authenticated administrator via Server-Side Template Injection in the FreeMarker email templating engine. The platform stores administrator-supplied email template content in its database and renders it without sandboxing controls, allowing FreeMarker directives to instantiate arbitrary Java classes and execute OS commands server-side. A detailed public proof-of-concept from FPT Cloud AppSec Research Team is available; no active exploitation is confirmed in CISA KEV at time of analysis.
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template engine's themeeditor.php. By crafting template conditional strings using PHP's alternative function call syntax, attackers bypass security filters and execute arbitrary PHP code on the server.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Template injection (CWE-1336) in the Drupal AI CKEditor module affects versions 0.0.0 through 1.4.3, allowing an authenticated Drupal user who can use the module's features to inject unneutralized template syntax that is later evaluated by a template engine, producing limited code injection. Successful exploitation requires the victim to interact with crafted content (CVSS PR:L/UI:R), and impact is confined to low confidentiality and integrity effects within the unchanged component scope. No public exploit code or active exploitation has been reported, and availability of an updated release (1.4.3) keeps priority at monitor level.
Server-side template injection in BottleCRM (Django-CRM) through 1.14.5 allows an authenticated member of an organization to have attacker-controlled text compiled as a Django template by the send_email Celery task, exposing the template rendering context and the Python modules loaded in the worker, or tying up the shared worker with nested loops. The flaw is reachable remotely without any victim interaction through POST /api/accounts/<id>/create_mail/ by supplying a crafted AccountEmail message_body, and it requires a valid account that belongs to the target organization (the CVSS vector specifies PR:L). Because the sink is django.template.Template() rather than Jinja2, the assessed impact is confined to tenant-scoped information disclosure and denial of service against the shared Celery worker, with no public exploit identified at time of analysis and no confirmed path to arbitrary code execution.
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty expressions into email templates, which execute with web process privileges when previewed or rendered. The vulnerability requires high-privilege back-office access, but successful exploitation enables arbitrary OS command execution and file read/write. No active exploitation has been confirmed and no public exploit code is currently identified.
Server-side template injection in Furion .NET Framework up to and including 4.9.9.95 allows an authenticated, low-privileged user to have attacker-supplied template expressions evaluated by the ViewEngine.RunCompile routine, potentially disclosing or tampering with data rendered through the view engine. The flaw is rated moderate (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:L) and is only reachable where a deployed application routes user-influenced content into RunCompile. Publicly available exploit code exists, and no CISA KEV entry confirms active exploitation.
Server-side template injection (SSTI) in formtools.org Form Tools up to and including version 3.1.1 allows an authenticated low-privilege user to inject template-engine metacharacters via the page_titles argument in Clients::updateClientSettingsTab, potentially causing limited information disclosure and modification within the application. Publicly available exploit code exists, but exploitation requires a valid low-privilege account and the assessed impact is capped at Low for confidentiality, integrity, and availability. The vendor was notified early through a GitHub issue but has not responded, and no patched version has been released.
Server-side template injection in the Email Template component of ThinkCMF up to 8.0.7 lets an authenticated administrator submit template content that the underlying template engine evaluates server-side, enabling data exposure or logic execution within the application's privileges. Exploitation requires a privileged session able to reach MailController::templatePut in cmf-api/src/admin/controller/MailController.php, so anonymous and low-privilege users cannot trigger it; publicly available exploit code exists (a GitHub write-up targeting ThinkCMF v8.0.1), but there is no indication of confirmed active exploitation in CISA KEV. No vendor patch has been issued because the vendor did not respond to the disclosure, and independent assessment rates this a genuinely low-priority finding despite the SSTI classification.
Server-side Twig template injection in Solspace Freeform 5.0.0 through 5.10.13 for Craft CMS 5.x lets unauthenticated attackers submit Twig expressions through public forms that are evaluated by Freeform's isolated Twig renderer when field values are rendered back into HTML attributes (the vendor fix excludes the value, name, and id attributes from rendering). Confirmed impact is limited to disclosure of PHP/core and Craft bootstrap constants such as PHP_VERSION, PHP_OS, CRAFT_BASE_PATH, and CRAFT_VENDOR_PATH, plus possible form rendering errors from malformed Twig; no access to Craft globals, getenv(), alias(), database or mailer credentials, security/license keys, arbitrary files, or code execution was demonstrated in testing. Publicly available exploit code exists in the form of one-line payloads published in the vendor's GitHub security advisory (e.g. {{ constant('PHP_VERSION') }}@example.com), but there is no evidence of confirmed active exploitation (not listed in CISA KEV); CVSS 5.3 and the advisory's isolated-sandbox findings indicate low severity.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.