CWE-1336: Server-Side Template Injection / SSTI
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Also known as Improper Neutralization of Special Elements Used in a Template Engine, Client-Side Template Injection / CSTI.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- open-metadata openmetadataOpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE8.5 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI5.2 Medium
- bagistoBagisto has SSTI in parameter that can lead to RCE7.3 High
- bagistoBagisto has SSTI via first and last name from low-privilege user (not admin)7.4 High
- bagistoBagisto has Normal & Blind SSTI from low-privilege user when ordering product8.9 High
- elated-themes frappeFrappe may be vulnerable remote code execution due to server-side template injection9.1 Critical
- mintlify, mintlify platform +1 moreA Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify...8.3 High
- arcadia technology, llc crafty controllerImproper Neutralization of Special Elements Used in a Template Engine in Crafty Controller9.9 Critical
- netaxis api orchestratorNetaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).9.8 Critical
- code-projects content management system, ctcms project ctcms +1 moreCTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine5.3 Medium
- frappe erpnextA Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89...8.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method...8.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions...4.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method...4.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text...8.8 High
- flarum friendsofflarum pretty mailFoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings8.6 High
- akauntingAkaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields8.6 High
- chancmsA template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows...9.8 Critical
- getgrav gravSecurity Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS8.8 High
- getgrav gravGrav is vulnerable to Server-Side Template Injection (SSTI) via Forms7.7 High
- getgrav gravGrav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection7.4 High
- getgrav gravGrav is vulnerable to RCE via SSTI through Twig Sandbox Bypass8.7 High
- logpoint siemAn issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System...6.9 Medium
- langchain-ai langchainLangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates8.3 High
- xibosignage xibo, xibo-cms +1 moreXibo CMS: Remote Code Execution through module templates7.2 High
- zhyd oneblogzhangyd-c OneBlog before 2.3.9 was vulnerable to SSTI (Server-Side Template Injection) via...9.8 Critical
uptime-kumanpmUptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read6.5 Medium- bagistobagisto - Server Side Template Injection (SSTI) in Product Description5.1 Medium
- elastic cloud enterprise (ece), cloud enterprise +1 moreElastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine9.1 Critical
- canonical lxdArbitrary File Read via Template Injection in Snapshot Patterns7.1 High
- wplakeorg advanced views – display custom fields (acf, pods, metabox), posts, cpt and woo products anywhere in gutenberg, elementor, divi, beaver…Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI8.8 High
- hubspot jinjavajinjava Sandbox Bypass via JavaType-Based Deserialization9.8 Critical
- solspace freeformThe Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability9.8 Critical
- agiloftAgiloft improper neutralization in EUI template engine4.8 Medium
- craftcms cms, craft cms +1 moreCraft Potential Remote Code Execution via Twig SSTI6.1 Medium
- crocoblock jetengineWordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability8.5 High
- thingsboardThingsBoard Add Gateway special elements used in a template engine5.3 Medium
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template9.1 Critical
- sawtooth software lighthouse studioSawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE10.0 Critical
- cyberark conjurConjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution8.6 High
- saleem-hadad larecipeLaRecipe is vulnerable to Server-Side Template Injection attacks10.0 Critical
- kingdee cloud-starry-sky enterprise editionKingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine6.9 Medium
- pyspur-dev pyspurPySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine5.3 Medium
- nautobotNautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating6.0 Medium
- knadh listmonklistmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user9.1 Critical
- skyvernSkyvern has a Jinja runtime leak8.5 High
- zhilink adp application developer platform, zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台 +1 morezhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template engine5.3 Medium
- invisioncommunity invision power board, invisioncommunity +1 moreInvision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings...10.0 Critical
- craftcms cms, craft cms +1 moreCraft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI7.3 High
- dell powerprotect data manager reporting, powerprotect data manager +1 moreDell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper...2.3 Low
- Show moreLoading…