CVE-2018-14716
SEOmatic plugin for Craft CMS SSTI Vulnerability
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
- Record
CVE-2018-14716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
- Record
CVE-2018-14716- Updated
- 2026-11-02
EUVDEUVD-2022-2812 No score
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
- Record
EUVD-2022-2812- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6j9m-rp7m-3gfg
SEOmatic plugin for Craft CMS SSTI Vulnerability
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
- Record
GHSA-6j9m-rp7m-3gfg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
- Record
CVE-2018-14716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-6j9m-rp7m-3gfg
SEOmatic plugin for Craft CMS SSTI Vulnerability
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
- Record
GHSA-6j9m-rp7m-3gfg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nystudio107/craft-seomaticPackagist |
before 3.1.4 | 3.1.4 |
nystudio107/craft-seomaticPackagist |
before 3.1.4, plus listed versions 3.0.03.0.0-beta.13.0.0-beta.103.0.0-beta.113.0.0-beta.12 Show 45 moreShow less3.0.0-beta.133.0.0-beta.143.0.0-beta.153.0.0-beta.163.0.0-beta.173.0.0-beta.183.0.0-beta.193.0.0-beta.23.0.0-beta.203.0.0-beta.213.0.0-beta.223.0.0-beta.233.0.0-beta.243.0.0-beta.33.0.0-beta.43.0.0-beta.53.0.0-beta.63.0.0-beta.73.0.0-beta.83.0.0-beta.93.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.23.0.203.0.223.0.233.0.243.0.253.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.1 |
3.1.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection | 2018-07-31 |
| PoC in GitHub | 0xB455/CVE-2018-14716 | 2024-05-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14716 is a high vulnerability (CVSS 7.5) in Nystudio107 Seomatic, published August 6, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 32.7%, the 98th percentile. Fixed in nystudio107/craft-seomatic 3.1.4.
References
exploit-db.com/exploits/45108
github.com/nystudio107/craft-seomatic/releases/tag/3.1.4
twitter.com/nystudio107/status/1021855169515057152
ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic
nvd.nist.gov/vuln/detail/CVE-2018-14716
Left out here: 2 versions. The JSON record has them.