CVE-2020-9757
SEOmatic for CraftCMS allows Server-Side Template Injection
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
- Record
CVE-2020-9757- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
- Record
CVE-2020-9757- Updated
- 2026-11-02
EUVDEUVD-2022-2843 No score
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
- Record
EUVD-2022-2843- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6q4j-8pjm-5mgc
SEOmatic for CraftCMS allows Server-Side Template Injection
The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.
- Record
GHSA-6q4j-8pjm-5mgc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
- Record
CVE-2020-9757- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-6q4j-8pjm-5mgc
SEOmatic for CraftCMS allows Server-Side Template Injection
The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.
- Record
GHSA-6q4j-8pjm-5mgc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nystudio107/craft-seomaticPackagist |
before 3.3.0 | 3.3.0 |
nystudio107/craft-seomaticPackagist |
before 3.3.0, plus listed versions 3.0.03.0.0-beta.13.0.0-beta.103.0.0-beta.113.0.0-beta.12 Show 45 moreShow less3.0.0-beta.133.0.0-beta.143.0.0-beta.153.0.0-beta.163.0.0-beta.173.0.0-beta.183.0.0-beta.193.0.0-beta.23.0.0-beta.203.0.0-beta.213.0.0-beta.223.0.0-beta.233.0.0-beta.243.0.0-beta.33.0.0-beta.43.0.0-beta.53.0.0-beta.63.0.0-beta.73.0.0-beta.83.0.0-beta.93.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.23.0.203.0.223.0.233.0.243.0.253.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.1 |
3.3.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Craft CMS < 3.3.0 - Server-Side Template Injection |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-9757 is a critical vulnerability (CVSS 9.8) in Craftcms Craft Cms, published March 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 72.8%, the 99th percentile. Fixed in nystudio107/craft-seomatic 3.3.0.
References
github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
nvd.nist.gov/vuln/detail/CVE-2020-9757
Left out here: 100 versions. The JSON record has them.