GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-1336

Allowed

Improper Neutralization of Special Elements Used in a Template Engine

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

411 vulnerabilities reference this CWE, most recent first.

GHSA-858Q-77WX-HHX6

Vulnerability from github – Published: 2025-12-02 01:24 – Updated: 2025-12-02 01:24
VLAI
Summary
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
Details

Summary

A user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.

Details

Grav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true). A user with publisher/editor privileges, that can create or edit pages and enable twig processing, can thereby inject arbitrary code that will execute in the context of the page render.

This enables exploitation of Grav internal APIs such as: - grav.user.update() and grav.user.save() for escalating the current user to super admin or admin - grav.scheduler.addCommand(), grav.scheduler.save() and grav.scheduler.run() for code execution

The Twig sandbox is not enforced in this context, allowing full access to any backend PHP object and method in the system/src/Grav/Common directory.

PoC

Preconditions:

  • You must have access to a non-admin user with permission to create/edit pages (admin.pages access)
  • For Privilege Escalation, you also have to be logged in to the site with the same user as the admin panel.

Steps to reproduce Privilege Escalation:

  1. Login into the non-admin page (default at cms-url/login).
  2. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
  3. Inject the following payload into the page content to escalate privileges:
{% set _ = grav.user.update({
    'access': {
        'admin': {
            'login': true,
            'super': true
        }
    }
}, {}) %}
{% set _ = grav.user.save() %}
  1. Visit the edited/created page url. The logged in user is now admin. (Note: For the changes to show, you need to log out of the admin panel and relogin).

Steps to reproduce Remote Code Execution:

  1. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
  2. Inject the following payload into the page content to execute commands:
{% set _ = grav.scheduler.addCommand('curl', ['http://localhost:8000']) %}
{% set _ = grav.scheduler.save() %}
{% set _ = grav.scheduler.run() %}
  1. Visit the page to trigger the execution. The system will issue a curl request.

Impact

This vulnerability allows: - Privilege Escalation from any user with page editing capabilities to full admin (super) access. - Remote Code Execution, as the attacker can run system arbitrary commands via the scheduler API.

It affects any Grav CMS installation where users with lower privileges are allowed to create or edit pages and Twig processing is not globally disabled.

Severity
7.4 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66297"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T01:24:19Z",
    "nvd_published_at": "2025-12-01T21:15:53Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.\n\n### Details\nGrav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true).\nA user with publisher/editor privileges, that can create or edit pages and enable twig processing, can thereby inject arbitrary code that will execute in the context of the page render.\n\nThis enables exploitation of Grav internal APIs such as:\n- `grav.user.update()` and `grav.user.save()` for escalating the current user to super admin or admin\n- `grav.scheduler.addCommand()`, `grav.scheduler.save()` and `grav.scheduler.run()` for code execution\n\nThe Twig sandbox is not enforced in this context, allowing full access to any backend PHP object and method in the `system/src/Grav/Common` directory.\n\n### PoC\n#### Preconditions:\n- You must have access to a **non-admin** user with permission to create/edit pages (```admin.pages``` access)\n- For Privilege Escalation, you also have to be logged in to the site with the same user as the admin panel.\n\n#### Steps to reproduce Privilege Escalation:\n1. Login into the non-admin page (default at `cms-url/login`).\n2. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -\u003e Process: Twig: true).\n3. Inject the following payload into the page content to escalate privileges:\n```\n{% set _ = grav.user.update({\n    \u0027access\u0027: {\n        \u0027admin\u0027: {\n            \u0027login\u0027: true,\n            \u0027super\u0027: true\n        }\n    }\n}, {}) %}\n{% set _ = grav.user.save() %}\n```\n4. Visit the edited/created page url. The logged in user is now admin. (*Note: For the changes to show, you need to log out of the admin panel and relogin).*\n\n#### Steps to reproduce Remote Code Execution:\n1. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -\u003e Process: Twig: true).\n2. Inject the following payload into the page content to execute commands:\n```\n{% set _ = grav.scheduler.addCommand(\u0027curl\u0027, [\u0027http://localhost:8000\u0027]) %}\n{% set _ = grav.scheduler.save() %}\n{% set _ = grav.scheduler.run() %}\n```\n3. Visit the page to trigger the execution. The system will issue a `curl` request.\n\n### Impact\nThis vulnerability allows:\n- Privilege Escalation from any user with page editing capabilities to full admin (super) access.\n- Remote Code Execution, as the attacker can run system arbitrary commands via the scheduler API.\n\nIt affects any Grav CMS installation where users with lower privileges are allowed to create or edit pages and Twig processing is not globally disabled.",
  "id": "GHSA-858q-77wx-hhx6",
  "modified": "2025-12-02T01:24:19Z",
  "published": "2025-12-02T01:24:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66297"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection"
}

GHSA-85QC-PP3M-XM3F

Vulnerability from github – Published: 2025-02-10 18:30 – Updated: 2025-02-26 21:30
VLAI
Details

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.

Severity
8.0 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-54954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-10T18:15:29Z",
    "severity": "HIGH"
  },
  "details": "OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.",
  "id": "GHSA-85qc-pp3m-xm3f",
  "modified": "2025-02-26T21:30:32Z",
  "published": "2025-02-10T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54954"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/kaoniniang2/03658cc78e789b992b378f4951bedfb7"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/yadong.zhang/DBlog/issues/IB6552"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-88F2-FPV8-89Q2

Vulnerability from github – Published: 2026-09-03 19:06 – Updated: 2026-09-03 19:06
VLAI
Summary
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Details

Summary

When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.

Details

return `http://api.x/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/v1/u`;

Prerequisite: the documented getBaseUrlFromSpecification: true option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server url field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with getBaseUrlFromSpecification: true, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.

Impact

With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Escape the server URL before emitting it into the URL template literal (escape backtick and ${), or build the base URL with an encoder that treats it as data; validate the URL. maintainer-report.txt make_spec.py reproduce.sh

Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "orval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62682"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-116",
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T19:06:52Z",
    "nvd_published_at": "2026-08-19T18:16:54Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nWhen Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec\u0027s `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.\n\n### Details\n\n```ts\nreturn `http://api.x/` + (globalThis.X = require(\"fs\").writeFileSync(\"/marker\",\"pwned\")) + `/v1/u`;\n```\n\nPrerequisite: the documented `getBaseUrlFromSpecification: true` option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server `url` field. Distinct from Orval\u0027s published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates a fetch client with `getBaseUrlFromSpecification: true`, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.\n\n### Impact\n\nWith that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.\n\n### Suggested fix\n\nEscape the server URL before emitting it into the URL template literal (escape backtick and `${`), or build the base URL with an encoder that treats it as data; validate the URL.\n[maintainer-report.txt](https://github.com/user-attachments/files/29396562/maintainer-report.txt)\n[make_spec.py](https://github.com/user-attachments/files/29396563/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29396564/reproduce.sh)",
  "id": "GHSA-88f2-fpv8-89q2",
  "modified": "2026-09-03T19:06:52Z",
  "published": "2026-09-03T19:06:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62682"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/pull/3692"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/orval-labs/orval"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)"
}

GHSA-8G7P-MX5X-8FRC

Vulnerability from github – Published: 2024-04-09 15:30 – Updated: 2024-04-09 15:30
VLAI
Details

A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.

Severity
6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-47542"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T15:15:28Z",
    "severity": "MODERATE"
  },
  "details": "A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.",
  "id": "GHSA-8g7p-mx5x-8frc",
  "modified": "2024-04-09T15:30:37Z",
  "published": "2024-04-09T15:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47542"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-23-419"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8G9W-79W6-CW84

Vulnerability from github – Published: 2026-01-29 21:30 – Updated: 2026-01-30 00:31
VLAI
Details

A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into env.from_string, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-69516"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-29T20:16:09Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.",
  "id": "GHSA-8g9w-79w6-cw84",
  "modified": "2026-01-30T00:31:22Z",
  "published": "2026-01-29T21:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69516"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/NtGabrielGomes/7c424367cc316fd7527f668ff076fece"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amidaware/tacticalrmm"
    },
    {
      "type": "WEB",
      "url": "https://www.amidaware.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8J6P-R8JG-MXQH

Vulnerability from github – Published: 2026-09-03 18:32 – Updated: 2026-09-03 18:32
VLAI
Summary
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Details

Summary

Orval's zod schema generation emits the header-parameter default value as a module-level template literal (export const Default =;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: a header parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. make_spec.py reproduce.sh

Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "orval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71871"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T18:32:03Z",
    "nvd_published_at": "2026-08-19T18:17:24Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nOrval\u0027s zod schema generation emits the **header-parameter** `default` value as a module-level template literal (`export const Default = `\u003cdefault\u003e`;`) without escaping `${` or the backtick. A default of the form `v${\u003ccode\u003e}w` injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import \u2014 no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.\n\n### Details\n\n```ts\nexport const \u2026Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import\n```\n\nMalicious input: a header parameter with a `default` of `v${\u003cattacker JS\u003e}w`. `${...}` permits any JS expression.\n\nNote: this is one of several `default`-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape `default` values) closes all of them, and a CNA may choose to consolidate the related reports.\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.\n\n### Impact\n\nCode execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.\n\n### Suggested fix\n\nEmit `default` values via a proper string-literal encoder (JSON.stringify, or escape backtick and `${` if a template literal must be used); never interpolate a spec value into a template literal. Apply to every `default` position. [make_spec.py](https://github.com/user-attachments/files/29399137/make_spec.py) [reproduce.sh](https://github.com/user-attachments/files/29399138/reproduce.sh)",
  "id": "GHSA-8j6p-r8jg-mxqh",
  "modified": "2026-09-03T18:32:03Z",
  "published": "2026-09-03T18:32:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71871"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/pull/3692"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/orval-labs/orval"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Orval: Import-time RCE via header-parameter default -\u003e zod module-level template literal"
}

GHSA-8QPG-H99J-C4J3

Vulnerability from github – Published: 2024-04-03 03:30 – Updated: 2024-08-16 18:30
VLAI
Details

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-24724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-03T03:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.",
  "id": "GHSA-8qpg-h99j-c4j3",
  "modified": "2024-08-16T18:30:56Z",
  "published": "2024-04-03T03:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24724"
    },
    {
      "type": "WEB",
      "url": "https://gibbonedu.org/download"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/177857"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8R2X-8F22-8FW5

Vulnerability from github – Published: 2025-08-20 09:30 – Updated: 2026-04-01 18:35
VLAI
Details

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection. This issue affects JetEngine: from n/a through 3.7.0.

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-53194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-82"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-20T08:15:39Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection. This issue affects JetEngine: from n/a through 3.7.0.",
  "id": "GHSA-8r2x-8f22-8fw5",
  "modified": "2026-04-01T18:35:54Z",
  "published": "2025-08-20T09:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53194"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-3-7-0-remote-code-execution-rce-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8V9W-WQXW-HP8G

Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 18:31
VLAI
Details

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates.

Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.

Severity
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-12107"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-19T10:16:09Z",
    "severity": "CRITICAL"
  },
  "details": "Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. \n\n Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.",
  "id": "GHSA-8v9w-wqxw-hp8g",
  "modified": "2026-02-19T18:31:54Z",
  "published": "2026-02-19T18:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12107"
    },
    {
      "type": "WEB",
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8WG7-WM29-2RVG

Vulnerability from github – Published: 2026-03-16 18:11 – Updated: 2026-03-16 21:57
VLAI
Summary
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
Details

The Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions.

This is possible even if allowAdminChanges is set to false.

Affected users should update to version 3.2.0 to mitigate the issue.

Severity
8.5 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/webhooks"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32261"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-16T18:11:23Z",
    "nvd_published_at": "2026-03-16T19:16:17Z",
    "severity": "HIGH"
  },
  "details": "The Webhooks plugin renders user-supplied template content through Twig\u2019s `renderString()` function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions.\n\nThis is possible even if `allowAdminChanges` is set to `false`.\n\nAffected users should update to version 3.2.0 to mitigate the issue.",
  "id": "GHSA-8wg7-wm29-2rvg",
  "modified": "2026-03-16T21:57:13Z",
  "published": "2026-03-16T18:11:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/webhooks/security/advisories/GHSA-8wg7-wm29-2rvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32261"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/webhooks"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin"
}
Mitigation
Architecture and Design

Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

Mitigation
Implementation

Use the template engine's sandbox or restricted mode, if available.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list