Common Weakness Enumeration

CWE-1336

Allowed

Improper Neutralization of Special Elements Used in a Template Engine

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

398 vulnerabilities reference this CWE, most recent first.

GHSA-82W3-G3Q9-MXC3

Vulnerability from github – Published: 2024-03-05 15:32 – Updated: 2025-03-28 18:32
VLAI
Details

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-27623"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-05T14:15:49Z",
    "severity": "MODERATE"
  },
  "details": "CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs.",
  "id": "GHSA-82w3-g3q9-mxc3",
  "modified": "2025-03-28T18:32:49Z",
  "published": "2024-03-05T15:32:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27623"
    },
    {
      "type": "WEB",
      "url": "https://github.com/capture0x/CMSMadeSimple2"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/pwning-cmsms-via-user-defined-tags-for-fun-and-learning-cve-2024-27622-27623"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-83JV-4PRM-34G7

Vulnerability from github – Published: 2024-05-21 21:00 – Updated: 2024-05-21 21:00
VLAI
Summary
Shopware Remote Code Execution Vulnerability
Details

Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/shopware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "5.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-21T21:00:39Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.\n",
  "id": "GHSA-83jv-4prm-34g7",
  "modified": "2024-05-21T21:00:39Z",
  "published": "2024-05-21T21:00:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopware5/shopware/commit/8f6a7cefcba7547276892b82f64e4874c1a0dfed"
    },
    {
      "type": "WEB",
      "url": "https://community.shopware.com/_detail_2015.html"
    },
    {
      "type": "WEB",
      "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2017?category=shopware-5-en/security-updates"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2017-06-22.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopware5/shopware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopware Remote Code Execution Vulnerability"
}

GHSA-83XR-5XXR-MH92

Vulnerability from github – Published: 2026-03-27 17:17 – Updated: 2026-03-27 17:17
VLAI
Summary
Incus vulnerable to arbitrary file read and write through pongo templates
Details

Summary

Instance template files can be used to cause arbitrary read or writes as root on the host server.

Details

Incus allows for pongo2 templates within instances which can be used at various times in the instance lifecycle to template files inside of the instance. This particular implementation of pongo2 within Incus allowed for file read/write but with the expectation that the pongo2 chroot feature would isolate all such access to the instance's filesystem.

This was allowed such that a template could theoretically read a file and then generate a new version of said file.

Unfortunately the chroot isolation mechanism is entirely skipped by pongo2 leading to easy access to the entire system's filesystem with root privileges.

Credit

This issue was discovered and reported by the team at 7asecurity

Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lxc/incus/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lxc/incus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T17:17:03Z",
    "nvd_published_at": "2026-03-26T23:16:20Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nInstance template files can be used to cause arbitrary read or writes as root on the host server.\n\n### Details\nIncus allows for pongo2 templates within instances which can be used at various times in the instance lifecycle to template files inside of the instance. This particular implementation of pongo2 within Incus allowed for file read/write but with the expectation that the pongo2 chroot feature would isolate all such access to the instance\u0027s filesystem.\n\nThis was allowed such that a template could theoretically read a file and then generate a new version of said file.\n\nUnfortunately the chroot isolation mechanism is entirely skipped by pongo2 leading to easy access to the entire system\u0027s filesystem with root privileges.\n\n### Credit\nThis issue was discovered and reported by the team at [7asecurity](https://7asecurity.com/)",
  "id": "GHSA-83xr-5xxr-mh92",
  "modified": "2026-03-27T17:17:03Z",
  "published": "2026-03-27T17:17:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-83xr-5xxr-mh92"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33897"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/commit/487edf5984fad89b0f762c03a7e211fdd38396fb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lxc/incus"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incus vulnerable to arbitrary file read and write through pongo templates"
}

GHSA-8535-HVM8-2HMV

Vulnerability from github – Published: 2025-12-02 01:25 – Updated: 2025-12-02 01:25
VLAI
Summary
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Details

Summary

Having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload. Sensitive information may be contained in the configuration details.

PoC

Create a simple form with two fields, 'registration-number' and 'hp'. Add a submit button and set the method to POST(screenshot attached below). Form name set to 'hero-form'. Send a POST request with the following payload and you will notice a response with a php array listing the whole Grav configuration details - including plugins(screenshot attached).

registration-number:d643aaaa

hp:vJyifp

form-name:hero-form

unique_form_id:{{var_dump(_context|slice(0,7))}}

Screenshot 2025-03-25 at 7 26 02 AM

Screenshot 2025-03-25 at 7 22 58 AM

Impact

Server-Side Template (SST) vulnerability. The vulnerability affects the latest Grav version as of 25th of Match 2025 (1.7.48) with all plugins installed (including forms plugin v.7.4.2) to their latest versions as well.

Severity
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T01:25:33Z",
    "nvd_published_at": "2025-12-01T22:15:49Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nHaving a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload. Sensitive information may be contained in the configuration details.\n\n### PoC\nCreate a simple form with two fields, \u0027registration-number\u0027 and \u0027hp\u0027. Add a submit button and set the method to POST(screenshot attached below). Form name set to \u0027hero-form\u0027. Send a POST request with the following payload and you will notice a response with a php array listing the whole Grav configuration details - including plugins(screenshot attached).\n\nregistration-number:d643aaaa\n\nhp:vJyifp\n\n__form-name__:hero-form\n\n__unique_form_id__:{{var_dump(_context|slice(0,7))}}\n\n\n![Screenshot 2025-03-25 at 7 26 02\u202fAM](https://github.com/user-attachments/assets/b92b099b-c07a-4ea2-a3f9-47361ceb9355)\n\n![Screenshot 2025-03-25 at 7 22 58\u202fAM](https://github.com/user-attachments/assets/d9146fd3-5887-4bf8-87d9-78f43ade91c8)\n\n\n### Impact\nServer-Side Template (SST) vulnerability. The vulnerability affects the latest Grav version as of 25th of Match 2025 (1.7.48) with all plugins installed (including forms plugin v.7.4.2) to their latest versions as well.",
  "id": "GHSA-8535-hvm8-2hmv",
  "modified": "2025-12-02T01:25:33Z",
  "published": "2025-12-02T01:25:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-8535-hvm8-2hmv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66298"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms"
}

GHSA-858Q-77WX-HHX6

Vulnerability from github – Published: 2025-12-02 01:24 – Updated: 2025-12-02 01:24
VLAI
Summary
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
Details

Summary

A user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.

Details

Grav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true). A user with publisher/editor privileges, that can create or edit pages and enable twig processing, can thereby inject arbitrary code that will execute in the context of the page render.

This enables exploitation of Grav internal APIs such as: - grav.user.update() and grav.user.save() for escalating the current user to super admin or admin - grav.scheduler.addCommand(), grav.scheduler.save() and grav.scheduler.run() for code execution

The Twig sandbox is not enforced in this context, allowing full access to any backend PHP object and method in the system/src/Grav/Common directory.

PoC

Preconditions:

  • You must have access to a non-admin user with permission to create/edit pages (admin.pages access)
  • For Privilege Escalation, you also have to be logged in to the site with the same user as the admin panel.

Steps to reproduce Privilege Escalation:

  1. Login into the non-admin page (default at cms-url/login).
  2. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
  3. Inject the following payload into the page content to escalate privileges:
{% set _ = grav.user.update({
    'access': {
        'admin': {
            'login': true,
            'super': true
        }
    }
}, {}) %}
{% set _ = grav.user.save() %}
  1. Visit the edited/created page url. The logged in user is now admin. (Note: For the changes to show, you need to log out of the admin panel and relogin).

Steps to reproduce Remote Code Execution:

  1. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
  2. Inject the following payload into the page content to execute commands:
{% set _ = grav.scheduler.addCommand('curl', ['http://localhost:8000']) %}
{% set _ = grav.scheduler.save() %}
{% set _ = grav.scheduler.run() %}
  1. Visit the page to trigger the execution. The system will issue a curl request.

Impact

This vulnerability allows: - Privilege Escalation from any user with page editing capabilities to full admin (super) access. - Remote Code Execution, as the attacker can run system arbitrary commands via the scheduler API.

It affects any Grav CMS installation where users with lower privileges are allowed to create or edit pages and Twig processing is not globally disabled.

Severity
7.4 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66297"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T01:24:19Z",
    "nvd_published_at": "2025-12-01T21:15:53Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.\n\n### Details\nGrav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true).\nA user with publisher/editor privileges, that can create or edit pages and enable twig processing, can thereby inject arbitrary code that will execute in the context of the page render.\n\nThis enables exploitation of Grav internal APIs such as:\n- `grav.user.update()` and `grav.user.save()` for escalating the current user to super admin or admin\n- `grav.scheduler.addCommand()`, `grav.scheduler.save()` and `grav.scheduler.run()` for code execution\n\nThe Twig sandbox is not enforced in this context, allowing full access to any backend PHP object and method in the `system/src/Grav/Common` directory.\n\n### PoC\n#### Preconditions:\n- You must have access to a **non-admin** user with permission to create/edit pages (```admin.pages``` access)\n- For Privilege Escalation, you also have to be logged in to the site with the same user as the admin panel.\n\n#### Steps to reproduce Privilege Escalation:\n1. Login into the non-admin page (default at `cms-url/login`).\n2. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -\u003e Process: Twig: true).\n3. Inject the following payload into the page content to escalate privileges:\n```\n{% set _ = grav.user.update({\n    \u0027access\u0027: {\n        \u0027admin\u0027: {\n            \u0027login\u0027: true,\n            \u0027super\u0027: true\n        }\n    }\n}, {}) %}\n{% set _ = grav.user.save() %}\n```\n4. Visit the edited/created page url. The logged in user is now admin. (*Note: For the changes to show, you need to log out of the admin panel and relogin).*\n\n#### Steps to reproduce Remote Code Execution:\n1. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -\u003e Process: Twig: true).\n2. Inject the following payload into the page content to execute commands:\n```\n{% set _ = grav.scheduler.addCommand(\u0027curl\u0027, [\u0027http://localhost:8000\u0027]) %}\n{% set _ = grav.scheduler.save() %}\n{% set _ = grav.scheduler.run() %}\n```\n3. Visit the page to trigger the execution. The system will issue a `curl` request.\n\n### Impact\nThis vulnerability allows:\n- Privilege Escalation from any user with page editing capabilities to full admin (super) access.\n- Remote Code Execution, as the attacker can run system arbitrary commands via the scheduler API.\n\nIt affects any Grav CMS installation where users with lower privileges are allowed to create or edit pages and Twig processing is not globally disabled.",
  "id": "GHSA-858q-77wx-hhx6",
  "modified": "2025-12-02T01:24:19Z",
  "published": "2025-12-02T01:24:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66297"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection"
}

GHSA-85QC-PP3M-XM3F

Vulnerability from github – Published: 2025-02-10 18:30 – Updated: 2025-02-26 21:30
VLAI
Details

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.

Severity
8.0 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-54954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-10T18:15:29Z",
    "severity": "HIGH"
  },
  "details": "OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.",
  "id": "GHSA-85qc-pp3m-xm3f",
  "modified": "2025-02-26T21:30:32Z",
  "published": "2025-02-10T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54954"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/kaoniniang2/03658cc78e789b992b378f4951bedfb7"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/yadong.zhang/DBlog/issues/IB6552"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8G7P-MX5X-8FRC

Vulnerability from github – Published: 2024-04-09 15:30 – Updated: 2024-04-09 15:30
VLAI
Details

A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.

Severity
6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-47542"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T15:15:28Z",
    "severity": "MODERATE"
  },
  "details": "A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.",
  "id": "GHSA-8g7p-mx5x-8frc",
  "modified": "2024-04-09T15:30:37Z",
  "published": "2024-04-09T15:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47542"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-23-419"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8G9W-79W6-CW84

Vulnerability from github – Published: 2026-01-29 21:30 – Updated: 2026-01-30 00:31
VLAI
Details

A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into env.from_string, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-69516"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-29T20:16:09Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.",
  "id": "GHSA-8g9w-79w6-cw84",
  "modified": "2026-01-30T00:31:22Z",
  "published": "2026-01-29T21:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69516"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/NtGabrielGomes/7c424367cc316fd7527f668ff076fece"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amidaware/tacticalrmm"
    },
    {
      "type": "WEB",
      "url": "https://www.amidaware.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QPG-H99J-C4J3

Vulnerability from github – Published: 2024-04-03 03:30 – Updated: 2024-08-16 18:30
VLAI
Details

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-24724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-03T03:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.",
  "id": "GHSA-8qpg-h99j-c4j3",
  "modified": "2024-08-16T18:30:56Z",
  "published": "2024-04-03T03:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24724"
    },
    {
      "type": "WEB",
      "url": "https://gibbonedu.org/download"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/177857"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8R2X-8F22-8FW5

Vulnerability from github – Published: 2025-08-20 09:30 – Updated: 2026-04-01 18:35
VLAI
Details

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection. This issue affects JetEngine: from n/a through 3.7.0.

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-53194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-82"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-20T08:15:39Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection. This issue affects JetEngine: from n/a through 3.7.0.",
  "id": "GHSA-8r2x-8f22-8fw5",
  "modified": "2026-04-01T18:35:54Z",
  "published": "2025-08-20T09:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53194"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-3-7-0-remote-code-execution-rce-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

Mitigation
Implementation

Use the template engine's sandbox or restricted mode, if available.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list