Server-Side Template Injection Vulnerability in CraftCMS by Pixel & Tonic

CVE-2023-30179

Summary

CraftCMS version 3.7.59 has a critical vulnerability that allows an authenticated attacker to exploit Server-Side Template Injection (SSTI) through the injection of malicious Twig Template code into the User Photo Location field within User Settings. This could potentially lead to Remote Code Execution, thus compromising the security of the affected system. Although the vendor indicates that only Administrators have permission to implement this Twig code addition, the implications of such access should not be underestimated, highlighting a significant risk in configurations allowing external entities to interact with Administrator functions.

References