CVE-2026-108264

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2026-108264

Wizarr, a management system for media servers like Jellyfin and Plex, is vulnerable to Server-Side Template Injection (SSTI) prior to version 2026.9.1 . The issue exists because wizard step Markdown—provided via the editor or imported bundles—is evaluated in a non-sandboxed Jinja2 environment wit...

CVE-2026-75597

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

CVE-2026-75597

The pyLoad download manager is vulnerable to unauthenticated access to sensitive Jinja2 templates. Prior to version 0.5.0b3.dev101 , the /web/ route in src/pyload/webui/app/blueprints/app_blueprint.py fails to enforce authentication, bypassing the @login_required protection used on direct routes ...

SGLang-0.5.9-RCE

SGLang SSTI إلى RCE PoC — عرض قالب محادثة Jinja2 بدون عزل رمل CVE-2026-5760 تنفيذ كود عن بُعد عبر حقن قالب من جانب الخادم SSTI في نقطة إعادة الترتيب في SGLang. يحقق ملف نموذج GGUF ضار يحتوي على tokenizer.chattemplate معدّلة تنفيذًا عشوائيًا للكود عند تحميله في SGLang واستدعاء نقطة النهاية...

CVE-2026-11104-Python-SSTI-via-Jinja2-attr-Filter-Bypass

CVE-2026-11104 – Python SSTI عبر تجاوز فلتر |attr في Jinja2 كود البرنامج Flask vulnerableapp.py - Flask with Jinja2 SSTI via 'attr' filter from flask import Flask, request, rendertemplatestring app = Flaskname @app.route'/' def index: name = request.args.get'name', 'World' UNSAFE: directly render...

Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE

Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows command execution via recipe steps. id: CVE-2025-23211 info: name: Tandoor Recipes 1.5.24 - Jinja2 SSTI RCE author: sammiee5311 severity: critical description: | Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

SSTI-Exploit-Detector

SSTI-Exploit-Detector SSTI Exploit Detector هو أداة مصممة لاكتشاف ثغرات حقن القوالب من جانب الخادم SSTI المحتملة في تطبيقات الويب. SSTI-Exploit-Detector Jenderal92 الميزات ملف الحمولات المخصص : يسمح للمستخدمين بإضافة حمولاتهم الخاصة لاختبار محركات القوالب المختلفة. الحمولات الافتراضية : يتضمن...

POC_CVE-2025-14700

CVE-2025-14700 PoC لـ CVE-2025-14700 ، ثغرة من نوع حقن القوالب من جانب الخادم SSTI في Crafty Controller = 4.6.1. تسمح هذه الثغرة للمستخدمين المصادق عليهم بتنفيذ أوامر عن بعد RCE عن طريق حقن قوالب Jinja2 ضارة في تكوين Webhook. 📦 التثبيت Clone the repository git clone...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

EUVD-2026-93660

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

PT-2026-106848

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

Rocky Linux 9.2 [CIQ] Security Update: python3-jinja2 Multiple Vulnerabilities (ciqsa-2026_1583)

The Rocky Linux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261583 advisory. This advisory aggregates security fixes for the python-jinja2 SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2025-27516, CVE-2024-22195. Tenable has...

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...