Server-Side Template Injection Vulnerability in CraftCMS by Pixel & Tonic

CVE-2023-30179

What is CVE-2023-30179?

CraftCMS version 3.7.59 has a critical vulnerability that allows an authenticated attacker to exploit Server-Side Template Injection (SSTI) through the injection of malicious Twig Template code into the User Photo Location field within User Settings. This could potentially lead to Remote Code Execution, thus compromising the security of the affected system. Although the vendor indicates that only Administrators have permission to implement this Twig code addition, the implications of such access should not be underestimated, highlighting a significant risk in configurations allowing external entities to interact with Administrator functions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References