{"id":"CVE-2021-31635","aliases":["EUVD-2023-1774","GHSA-cgmm-c2m9-ff7r"],"status":"published","title":"jFinal Server-Side Template Injection vulnerability","description":"Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01206,"percentile":0.68752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2023-06-26T00:00:00Z","modified":"2026-10-20T10:54:40Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.jfinal:jfinal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.9.08"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.jfinal:jfinal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.9.08"}]}],"versions":["1.4","1.4.0","1.5","1.6","1.8","1.9","2.0","2.1","2.2","3.0","3.1","3.2","3.3","3.4","3.5","3.6","3.7","3.8","4.0","4.1","4.2","4.3","4.4","4.5","4.6","4.7","4.8","4.9","4.9.01","4.9.02","4.9.03","4.9.04","4.9.05","4.9.06","4.9.07","4.9.08"]}],"products":[{"vendor":"jfinal","product":"jfinal"}],"references":[{"url":"https://github.com/jfinal/jfinal/issues/187","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31635","tags":["advisory"]},{"url":"https://gitee.com/jfinal/jfinal/issues/I3IXLE","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cgmm-c2m9-ff7r"}],"sources":{"cve":[{"id":"CVE-2021-31635","description":"Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.","status":"published","published":"2023-06-26T00:00:00Z","modified":"2024-12-05T15:32:17.532Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2023-1774","description":"Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.","status":"published","published":"2023-06-26T00:00:00Z","modified":"2024-12-05T15:32:17Z","updated_at":"2026-11-03T00:04:40.064683Z"}],"ghsa":[{"id":"GHSA-cgmm-c2m9-ff7r","title":"jFinal Server-Side Template Injection vulnerability","description":"Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.","status":"published","published":"2023-06-26T21:30:59Z","modified":"2024-12-05T19:06:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2021-31635","description":"Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.","status":"published","published":"2023-06-26T19:15:09.667Z","modified":"2026-06-17T03:52:06.163Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"CVE-2021-31635","description":"Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.","status":"published","published":"2023-06-26T19:15:09.667Z","modified":"2026-10-20T10:54:40.380851834Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"GHSA-cgmm-c2m9-ff7r","title":"jFinal Server-Side Template Injection vulnerability","description":"Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.","status":"published","published":"2023-06-26T21:30:59Z","modified":"2024-12-05T19:25:38.184971Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}