CVE-2026-52762 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839

Grav before 2.0.16 is affected by an information disclosure vulnerability in its sandboxed Twig templates. The allow-listed offsetGet() and offsetexists() methods lack field filtering on User objects , permitting attackers with page-edit permissions to extract hashed passwords and 2FA secrets , e...

CVE-2026-76839: Insufficiently Protected Credentials

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

PT-2026-81146

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...

Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-596p-6jv8-775v. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and...

CVE-2026-46637 Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with issafe = all, causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly...

Remote Code Execution

Craft CMS is vulnerable to remote code execution RCE. The vulnerability is due to unsafe rendering of user-controlled data as an unsandboxed Twig template, where the Referer HTTP header is compiled without sandboxing during entry saves, allowing authenticated attackers to execute arbitrary code o...

GHSA-65P8-9433-JPCP YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

Summary YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig expressions into the Semantic template Twig field...

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

Summary YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig expressions into the Semantic template Twig field...

PT-2026-57025

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6 Description YesWiki Bazar contains a stored Server-Side Template Injection SSTI in the semantic template feature. SSTI occurs when an application embeds user-supplied input into a server-side template without...

ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

The Events, Conditions, Actions ECA module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is...

PT-2026-56663

Name of the Vulnerable Software and Affected Versions ECA: Event - Condition - Action versions 0.0.0 through 2.1.20 ECA: Event - Condition - Action versions 3.0.0 through 3.0.12 ECA: Event - Condition - Action versions 3.1.0 through 3.1.4 Description Improperly controlled modification of...

GHSA-9FX4-7CMJ-47VG Mautic has Server-Side Template Injection (SSTI) in Theme Templates

Summary A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code...

CVE-2026-9558

A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the...

CVE-2026-9558

A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the...

CVE-2026-9558

This CVE describes a Server-Side Template Injection (SSTI) in Mautic’s theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. With authenticated access to create or upload themes, an attacker could execute arbitrary code on the hosting server...

CVE-2026-9558

A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the...

CVE-2026-9558

A Server-Side Template Injection SSTI vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the...

Mautic 安全漏洞

Mautic is an open-source marketing automation software developed by Mautic. This software can monitor and manage websites, send emails, and manage customer resources. Mautic has a security vulnerability, which stems from server-side template injection in the theme engine. This vulnerability may...