SSTI learning path

Orientation and first principles — what the bug class is and how it behaves.

1. SSTI: Explanation, Discovery, Exploitation, and Prevention
   6 min readakto.io2026
   Library detailing Server-Side Template Injection (SSTI) vulnerabilities, covering explanation, discovery techniques, exploitation examples like arbitrary code execution and file system manipulation using payloads targeting systems using Jinja2 and ERB, and prevention strategies focusing on avoiding user input in templates. The resource references the PageUp data breach as an SSTI-related incident and includes practical demonstrations using Portswigger's SSTI lab.
2. Server-side template injection | Web Security Academy
   8 min readportswigger.net2026
   Library explaining server-side template injection, a vulnerability where attackers inject malicious payloads into templates to achieve remote code execution or access sensitive data. It details how these vulnerabilities arise when user input is directly concatenated into templates instead of being passed as data, and outlines detection methods like fuzzing with special characters and testing mathematical operations in plaintext or code contexts, applicable to engines like Twig and Freemarker.
3. What is SSTI in Flask/Jinja2? — Payatu
   6 min readpayatu.com2026
   Walkthrough of Server-Side Template Injection (SSTI) in Flask applications using Jinja2. This guide demonstrates how user-controlled data, when rendered directly by Jinja2's `render_template_string`, can lead to vulnerabilities. It details techniques for discovering SSTI via arithmetic expressions, exploiting it to dump application configuration, and navigating Python's object inheritance tree using `__mro__` and `__subclasses__` to read server files and achieve remote code execution.
4. A Simple Flask (Jinja2) SSTI Example (Kleiber)
   9 min readkleiber.me2026
   Library demonstrating Server-Side Template Injection (SSTI) in Flask and Jinja2. This resource walks through exploiting the templating engine's ability to render dynamic content, focusing on how to navigate Python's object inheritance tree using `__class__`, `__base__`, and `__subclasses__` to achieve remote code execution, similar to techniques seen in the TryHackMe "Temple" room.
5. SSTI: Transforming Web Apps from Assets to Liabilities
   12 min readresearch.checkpoint.com2026
   Library for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. It details risks such as arbitrary code execution and data theft, noting real-world impacts on platforms like Atlassian Confluence and CrushFTP. The library covers techniques including fuzzing, blind SSTI detection using `sleep` commands, and `nslookup` for DNS-based validation, applicable to template engines like Jinja2, Freemarker, and Twig.

Real testing methodology, tooling, and writeups that show the work.

1. SSTI: Breaking Out of Templates
   8 min readkayssel.com2026
   Library for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities, covering engines like Jinja2, Twig, Freemarker, and ERB. It details how template engines work, identifies vulnerabilities through error messages and syntax variations, and provides engine-specific payloads for Remote Code Execution (RCE), including sandbox escape techniques and filter bypasses. The library also references tools such as tplmap and SSTImap for automated detection and exploitation.
2. Inj3ctlab — SSTI Bug Bounty Labs Writeup
   6 min readlen4m.github.io2026
   Writeup detailing the process of solving the Inj3ctlab laboratory for practicing Server-Side Template Injection (SSTI). It covers detecting SSTI in three distinct technologies (PHP, Node.js, and Python), identifying template engines like Jinja2 and EJS, and escalating injections to achieve RCE through techniques such as arithmetic evaluation and exploiting template engine functionalities. The writeup includes enumeration steps using Nmap and provides insights into the vulnerability context, exploitation phases, security impact, and mitigation recommendations.
3. Exploiting SSTI in Golang Frameworks
   5 min readpayatu.com2026
   Writeup exploring Server-Side Template Injection (SSTI) in Golang frameworks like Gin, Echo, and Fiber. It details how attackers can exploit template engines by traversing objects to achieve remote code execution. Specific techniques and payloads are demonstrated for arbitrary file reading using Echo's `.File` and `.Attachment` gadgets, Cross-Site Scripting via Gin's context, and Denial of Service through Fiber's `.App.Shutdown`.
4. Atlassian Confluence Widget Connector Macro SSTI (ExploitDB)
   13 min readexploit-db.com2026
   Tool for exploiting CVE-2019-3396 in Atlassian Confluence's Widget Connector macro. This script enables path traversal for file disclosure and directory listing, as well as Remote Code Execution (RCE) by uploading a crafted Velocity template. The RCE functionality requires an authenticated session to upload the template to a user's personal space, while path traversal can be exploited without authentication to browse server file systems.
5. Jinja2 template injection filter bypasses (0day.work)
   5 min read0day.work2026
   Writeup detailing bypasses for Jinja2 template injection filter mechanisms. This resource explores techniques to circumvent blacklists designed to prevent direct access to `__class__` and the use of bracket notation. It demonstrates how to use string multiplication with `|join`, the `|attr()` function, and list concatenation via `|format` to construct payloads that evade filtering, ultimately enabling Remote Code Execution. The writeup highlights the inherent insecurity of blacklist filtering and advocates for whitelisting.

Novel research, edge cases, and the techniques that push the class forward.

1. SSTI: Advanced Exploitation Guide - Intigriti
   9 min readintigriti.com2026
   Library on advanced Server-Side Template Injection (SSTI) exploitation, detailing identification and weaponization techniques. It covers various template engines including Jinja2, Twig, ERB, EJS, Handlebars, Pug, Thymeleaf, FreeMarker, Pebble, Razor, and Mako. The resource explains how to bypass sandboxed environments by chaining objects and leveraging native template engine features, offering practical examples for escalating basic injections to remote code execution.
2. YesWeHack: Limitations are just an illusion — advanced SSTI exploitation with RCE everywhere
   7 min readyeswehack.com2026
   Writeup detailing advanced Server-Side Template Injection (SSTI) exploitation techniques, demonstrating Remote Code Execution (RCE) without relying on quotes or external plugins across Jinja2, Mako, Twig, Smarty, Blade, Groovy, FreeMarker, and Razor template engines. It showcases how to leverage built-in functions like `chr`, `popen`, `passthru`, and `implode`, along with engine-specific features like Python's `__init__.__globals__` or Twig's block functionality, to bypass auto-escaping and achieve RCE in diverse application security contexts.
3. Server-Side Template Injection | PortSwigger Research
   18 min readportswigger.net2026
   Reference for Server-Side Template Injection (SSTI) details a methodology for detecting and exploiting template engines like Twig and FreeMarker, which are commonly used to embed dynamic content. SSTI vulnerabilities arise when user input is unsafely embedded in templates, potentially leading to Remote Code Execution (RCE). The research outlines detection techniques for both "text" and "variable" contexts, emphasizing the importance of identifying the specific template engine and its documentation to craft effective exploits, including escaping sandbox modes.
4. Method Confusion in Go SSTIs Lead to RCE
   3 min readonsecurity.io2026
   Library for Go Server-Side Template Injection (SSTI) research, detailing method confusion vulnerabilities in the `html/template` and `text/template` modules. It demonstrates how to achieve Remote Code Execution (RCE) and file read capabilities by calling exported methods with controlled parameters, offering a new avenue for exploitation beyond simple XSS. Specific examples include leveraging the `Person.Secret` method for command execution and the `echo.Context.File` method for local file reading.
5. A Survey of the Overlooked Dangers of Template Engines (arXiv 2024)
   57 min readarxiv.org2026
   Survey of template engines, focusing on Remote Code Execution (RCE) via Server-Side Template Injection (SSTI). This paper analyzes 34 template engines across eight languages, categorizing RCE paths and mitigation strategies. It highlights common vulnerabilities, information disclosure, unauthorized access, and DoS, emphasizing RCE as a critical threat often overlooked in current research. The work also examines real-world SSTI instances and CVEs from platforms like HackerOne.
6. Template Injection Research | PortSwigger Research
   2 min readportswigger.net2026
   Library covering template injection, detailing both Client Side Template Injection (CSTI) and Server Side Template Injection (SSTI). Learn techniques to bypass Content Security Policy (CSP) and exploit client-side vulnerabilities similar to Cross-Site Scripting (XSS), including breaking the AngularJS sandbox as presented at BSides Manchester. Explore server-side exploitation, detecting templating engines, and achieving Remote Code Execution (RCE), including research presented at Black Hat USA on SSTI.
7. SSTI: Advanced Exploitation Techniques (BootstrapSecurity)
   medium.com2026
   SSTI: Advanced Exploitation Techniques (BootstrapSecurity)
8. SSTI: RCE for the Modern Web App - Black Hat 2015
   blackhat.com2026
   SSTI: RCE for the Modern Web App - Black Hat 2015