The newest Server-Side Template Injection (SSTI) resources are on the Server-Side Template Injection (SSTI) page. For a reading order instead of a date order, see the Server-Side Template Injection (SSTI) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-19 2026 | Server-Side Template Injection — Bug Bounty 2k25 beginner | Server-Side Template Injection — Bug Bounty 2k25 |
| 2026-04-19 2026 | What is SSTI in Flask/Jinja2? — Payatu beginner 6 min read | Walkthrough of Server-Side Template Injection (SSTI) in Flask applications using Jinja2. This guide demonstrates how user-controlled data, when rendered directly by Jinja2's `render_template_string`, can lead to vulnerabilities. It details techniques for discovering SSTI via arithmetic expressions, exploiting it to dump application configuration, and navigating Python's object inheritance tree using `__mro__` and `__subclasses__` to read server files and achieve remote code execution. |
| 2026-04-19 2026 | PayloadsAllTheThings — SSTI README beginner 4 min read RCE | Library detailing Server-Side Template Injection (SSTI) techniques, including detection and exploitation methods. It covers rendered, error-based, and boolean-based SSTI, as well as polyglot payloads like `${{<%['"}}%\.` and tools such as Hackmanit/TInjA and epinna/tplmap. The resource also references research on template engine identification and exploitation, like James Kettle's work and Maximilian Hildebrand's polyglot research. |
| 2026-04-19 2026 | Find and Exploit Server-Side Template Injection — TCM Security beginner 4 min read | Library for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. It covers basic evaluations, retrieving application classes, reading files, and executing system commands through template syntax variations, referencing the PayloadsAllTheThings repository for additional payloads. Detection involves identifying input points, fuzzing with template syntax, testing built-in functions, monitoring error messages, and observing delayed responses, as seen in cases like rider.uber.com. |
| 2026-04-17 2026 | Active Exploitation of Confluence CVE-2022-26134 (Rapid7) intermediate 9 min read | Writeup of CVE-2022-26134 details an unauthenticated OGNL injection vulnerability in Confluence Server and Data Center, allowing remote code execution. The vulnerability is actively exploited in the wild, with proof-of-concept exploits targeting HTTP requests to inject OGNL payloads. Successful exploitation allows attackers to execute commands and exfiltrate output via HTTP response headers, similar to the previous CVE-2021-26084. Rapid7's analysis highlights the OGNL injection mechanism and provides examples of exploitation, emphasizing the risk to internet-facing instances. → rapid7.com |
| 2026-04-17 2026 | Atlassian Confluence Widget Connector Macro SSTI (ExploitDB) intermediate 13 min read | Tool for exploiting CVE-2019-3396 in Atlassian Confluence's Widget Connector macro. This script enables path traversal for file disclosure and directory listing, as well as Remote Code Execution (RCE) by uploading a crafted Velocity template. The RCE functionality requires an authenticated session to upload the template to a user's personal space, while path traversal can be exploited without authentication to browse server file systems. → exploit-db.com |
| 2026-04-17 2026 | SSTItoXSS: Exploiting SSTI to bypass WAF/XSS Filter intermediate | SSTItoXSS: Exploiting SSTI to bypass WAF/XSS Filter |
| 2026-04-17 2026 | SSTI (The Hacker Recipes) beginner 4 min read | Library detailing Server-Side Template Injection (SSTI) vulnerabilities, covering identification of input vectors and exploit techniques for engines like Jinja2 and Twig. It demonstrates payloads for RCE, including those utilizing `os.popen` and context-independent methods. The library also addresses WAF bypasses via bracket notation and hexadecimal encoding, and provides guidance for developers on secure templating practices, contrasting vulnerable code with fixed alternatives. |
| 2026-04-17 2026 | Exploiting CVE-2021-25770: SSTI in YouTrack (Synacktiv) intermediate 3 min read | Writeup detailing CVE-2021-25770, a critical Server-Side Template Injection in JetBrains YouTrack versions prior to 2020.5.3123. This analysis focuses on leveraging Freemarker's `DEFAULT_WRAPPER` field and a sandbox bypass technique presented at Blackhat USA 2020 to achieve remote code execution, bypassing the ALLOWS_NOTHING_RESOLVER configuration. |
| 2026-04-17 2026 | SSTI in Freemarker (Akto) intermediate 1 min read | Library for detecting Server-Side Template Injection (SSTI) in FreeMarker. It identifies vulnerable request payloads and query parameters using regular expressions, then injects test expressions like "${89*91}" into "payloadKey" and "queryKey" parameters. Successful exploitation is validated by checking for the string "8099" in the response. |
| 2026-04-17 2026 | Ruby ERB Template Injection (TrustedSec) intermediate 5 min read | Walkthrough of Ruby ERB template injection detailing techniques to identify template engines, enumerate accessible classes/methods, and exploit them for actions like reading files or command execution. The analysis demonstrates how to use introspection with methods like `.methods` and `.name` to discover program internals, revealing exploitable parameters and objects. It specifically shows how to exploit a Ruby/ERB template engine, even with a safe level setting, to access sensitive data such as the server's private key via the `@ssl_context` instance variable within WEBrick. |
| 2026-04-17 2026 | PayloadsAllTheThings: SSTI Ruby payloads intermediate | Cheatsheet detailing Server-Side Template Injection (SSTI) payloads for Ruby applications. It covers common templating engines like ERB and Slim, demonstrating techniques for remote code execution (RCE) through generic injection payloads. Examples include using `%x('id')` for RCE, `File.read("Y:/A:/"+%x('id'))` for error-based RCE, `1/(system("id")&&1||0)` for boolean-based RCE, and `system("id && sleep 5")` for time-based RCE. It also shows how to execute commands with `IO.popen` and `Open3`/`Open4`. |
| 2026-04-17 2026 | Code Execution via SSTI Ruby ERB (Invicti) intermediate | Library for detecting Server-Side Template Injection (SSTI) in Ruby ERB. This vulnerability can allow an attacker to execute arbitrary code or system commands by improperly using template engine tags instead of string literals. The library focuses on the risk of code execution when user-supplied data is directly included in templates. Developers should pass user-controlled parameters as template parameters rather than concatenating them directly into the template. → invicti.com |
| 2026-04-17 2026 | ruby-ssti: example Ruby ERB app vulnerable to SSTI beginner 3 min read | Library demonstrating Server-Side Template Injection (SSTI) in Ruby ERB applications. This resource allows users to detect and exploit vulnerabilities where user input, not properly validated, is embedded into ERB templates, potentially leading to arbitrary code execution. It showcases how an attacker can inject malicious Ruby code to read sensitive files like `/etc/passwd` by manipulating the `name` parameter in a Sinatra application. The library also highlights the importance of sanitizing user input and understanding ERB's safe level settings to prevent such attacks. |
| 2026-04-17 2026 | Setting Up a Vulnerable SSTI Lab: A Hands-On Guide beginner | Setting Up a Vulnerable SSTI Lab: A Hands-On Guide |
| 2026-04-17 2026 | SSTI in Flask/Jinja2 (IndominusByte) intermediate | SSTI in Flask/Jinja2 (IndominusByte) |
| 2026-04-17 2026 | tplmap-python3: Python3 port (GitHub) intermediate 2 min read | Tool for exploiting Server-Side Template Injection (SSTI) and code injection vulnerabilities. It assists penetration testers by identifying and exploiting SSTI flaws across various template engines, including Jinja2, and supports sandbox escape techniques to gain OS access, execute commands, and perform file operations. The project leverages research from James Kett and others, and can handle blind injection scenarios and eval()-like code injections in Python, Ruby, PHP, and Java. |
| 2026-04-17 2026 | Lab: SSTI in an unknown language with documented exploit intermediate | Lab: SSTI in an unknown language with documented exploit |
| 2026-04-17 2026 | PayloadsAllTheThings - SSTI JavaScript engines intermediate 1 min read | Reference for Server-Side Template Injection (SSTI) in JavaScript engines, detailing payloads for Handlebars, EJS, PugJS, UnderscoreJS, Eta, and NunjucksJS. It includes methods for Remote Code Execution (RCE) via generic injection, error-based, boolean-based, and time-based techniques. The reference also covers Handlebars versions affected by GHSA-q42p-pg8m-cqh6 and provides examples of payload construction using Lodash. |
| 2026-04-17 2026 | HackerOne Report #423541: H1514 Server Side Template Injection news | HackerOne Report #423541: H1514 Server Side Template Injection → hackerone.com |
| 2026-04-17 2026 | A Simple Flask (Jinja2) SSTI Example (Kleiber) beginner 9 min read | Library demonstrating Server-Side Template Injection (SSTI) in Flask and Jinja2. This resource walks through exploiting the templating engine's ability to render dynamic content, focusing on how to navigate Python's object inheritance tree using `__class__`, `__base__`, and `__subclasses__` to achieve remote code execution, similar to techniques seen in the TryHackMe "Temple" room. |
| 2026-04-17 2026 | Strapi Security Disclosure: Multi-CVE SSTI chain news 8 min read | Writeup detailing multiple CVEs affecting Strapi, including CVE-2023-22621 (SSTI to RCE in Users-Permissions Plugin), CVE-2023-22893 (Authentication Bypass for AWS Cognito), and CVE-2023-22894 (Leaking Sensitive User Information by Filtering on Private Fields). The writeup provides vulnerability summaries, affected versions, patching instructions, and indicators of compromise for each. |
| 2026-04-17 2026 | Bug Bytes #124: SSTI to RCE in Go apps (Intigriti) intermediate 5 min read | Article detailing Server-Side Template Injection (SSTI) to Remote Code Execution (RCE) in Go applications, building upon existing XSS research by demonstrating how template injection can lead to file reads or RCE through imported modules. This research addresses a gap in publicly available SSTI techniques for Go. |
| 2026-04-17 2026 | Top 25 RCE Bug Bounty Reports (Cristian Cornea) intermediate | Top 25 RCE Bug Bounty Reports (Cristian Cornea) → corneacristian.medium.com |
| 2026-04-17 2026 | What is Server-Side Template Injection? (Indusface) beginner 4 min read | Library for understanding and preventing Server-Side Template Injection (SSTI). SSTI occurs when unvalidated user input is processed by template engines like Jinja2, Freemarker, or Twig, potentially leading to Remote Code Execution (RCE), data exfiltration, and server takeover. The library covers identifying vulnerable input points, crafting payloads, and exploitation goals, along with prevention techniques such as input validation, whitelisting, secure template engine usage, and deploying Web Application Firewalls (WAFs) like AppTrana. |
| 2026-04-17 2026 | Mastering SSTI Exploitation: Executing Commands in Popular Templating Engines intermediate | Mastering SSTI Exploitation: Executing Commands in Popular Templating Engines |
| 2026-04-17 2026 | SSTI: Advanced Exploitation Techniques (BootstrapSecurity) advanced | SSTI: Advanced Exploitation Techniques (BootstrapSecurity) |
| 2026-04-17 2026 | Jinja2 template injection filter bypasses (0day.work) intermediate 5 min read | Writeup detailing bypasses for Jinja2 template injection filter mechanisms. This resource explores techniques to circumvent blacklists designed to prevent direct access to `__class__` and the use of bracket notation. It demonstrates how to use string multiplication with `|join`, the `|attr()` function, and list concatenation via `|format` to construct payloads that evade filtering, ultimately enabling Remote Code Execution. The writeup highlights the inherent insecurity of blacklist filtering and advocates for whitelisting. |
| 2026-04-17 2026 | Jinja2/Flask SSTI Filter bypass (MRLSECURITY) intermediate 1 min read | Writeup demonstrating Server-Side Template Injection (SSTI) bypass in Jinja2/Flask applications, even with characters like `{{`, `}}`, `.`, `_`, `[`, `]`, `\`, and `x` banned. The technique leverages access to the `request` object and its `attr()` method to construct payloads, such as sending `__base__` via GET parameters to retrieve `dict.__base__`, enabling full SSTI exploitation. |
| 2026-04-17 2026 | SSTI - Server-side template injection with a custom exploit (Scott Murray) intermediate 9 min read | Library for exploiting Server-Side Template Injection (SSTI) vulnerabilities, specifically demonstrating a custom exploit against the PortSwigger Web Security Academy lab. The process involves reconnaissance to identify the templating engine (Twig on PHP), crafting payloads to bypass syntax errors and trigger execution, and leveraging object properties to read arbitrary files like `/etc/passwd` and `/home/carlos/User.php`, ultimately aiming to delete sensitive files such as `/.ssh/id_rsa`. |
| 2026-04-17 2026 | picoCTF 2025: SSTI2 Exploitation Writeup intermediate | picoCTF 2025: SSTI2 Exploitation Writeup |
| 2026-04-17 2026 | picoCTF 2025: SSTI Challenge Writeup intermediate | picoCTF 2025: SSTI Challenge Writeup |
| 2026-04-16 2026 | SSTI: RCE for the Modern Web App - Black Hat 2015 advanced | SSTI: RCE for the Modern Web App - Black Hat 2015 → blackhat.com |
| 2026-04-16 2026 | Server Side Template Injection - Payloads All The Things beginner 4 min read | Reference list detailing Server Side Template Injection (SSTI) techniques, including Rendered, Error-Based, Boolean-Based, and Time-Based exploitation methods. It highlights tools such as Hackmanit/TInjA, epinna/tplmap, and SSTImap for detection and exploitation, and references research papers on polyglot-based scanning and new code injection techniques, such as those by James Kettle and Maximilian Hildebrand. |
| 2026-04-16 2026 | Practical Exploitation of SSTI in Flask with Jinja2 intermediate 3 min read | Lab application demonstrating Server-Side Template Injection (SSTI) in Flask with Jinja2, allowing safe local exploration of exploitation from discovery to Remote Code Execution (RCE) and Cross-Site Scripting (XSS). It showcases payloads for reading files, executing commands, and achieving RCE via reverse shell, alongside HTML injection examples. The resource also provides prevention strategies including preferring `render_template()` over `render_template_string()`, input validation, leveraging Jinja2's auto-escaping, and using a restricted sandbox environment. |
| 2026-04-16 2026 | SSTI Explained with Real Code Examples - Xygeni beginner 3 min read | Library for detecting and preventing Server-Side Template Injection (SSTI). It details how vulnerabilities in templating engines like Jinja2, Twig, and Velocity allow attackers to inject payloads, ranging from arithmetic expressions ({{7*7}}) to code execution, and highlights risks in CI/CD pipelines, Helm charts, and email templates. The library emphasizes secure coding practices like avoiding direct rendering of user input, using sandboxed templates, and integrating checks into DevSecOps pipelines to catch unsafe template usage and block SSTI vulnerabilities. |
| 2026-04-16 2026 | Deep Dive into SSTI: Finding and Exploiting Like a Pro advanced | Deep Dive into SSTI: Finding and Exploiting Like a Pro → infosecwriteups.com |
| 2026-04-11 2026 | CVE-2022-46166: Spring Boot Admin RCE news | CVE-2022-46166: Spring Boot Admin RCE |
| 2026-04-11 2026 | CVE-2021-43466: Thymeleaf Spring5 RCE news | Library for analyzing the SNYK-JAVA-ORGTHYMELEAF-1915389 vulnerability, an RCE in Thymeleaf Spring5. This exploit targets the render function in AjaxThymeleafView.java, allowing attackers to inject malicious input. The entry also references EPSS model data for threat probability and percentile. → security.snyk.io |
| 2026-04-11 2026 | Handlebars.js: Safe Usage to Avoid Injection Flaws beginner 5 min read | Library for secure Handlebars.js usage, detailing vulnerabilities like Cross-Site Scripting (XSS), Prototype Pollution (GHSA-2cf5-4w76-r9qv), and Server-Side Template Injection (SSTI). It highlights risks associated with triple braces `{{{}}}`, unsafe custom helpers, and improper compilation, citing real-world exploits in Asana and npm packages. The resource advocates for double brace usage, input validation, restricting dangerous helpers, and implementing Content Security Policy (CSP), also offering guidance on automating template validation in CI/CD pipelines. |
| 2026-04-11 2026 | HackerOne #164224: SSTI intermediate | HackerOne #164224: SSTI → hackerone.com |
| 2026-04-11 2026 | AST Injection: Prototype Pollution to RCE in Handlebars advanced 4 min read | Writeup detailing AST injection techniques to achieve Remote Code Execution (RCE) in NodeJS applications utilizing template engines like Handlebars and Pug. The analysis demonstrates how prototype pollution vulnerabilities can be leveraged to insert malicious Abstract Syntax Tree (AST) nodes into the compilation process, bypassing input validation and leading to arbitrary command execution. Examples are provided using the vulnerable `flat` module. |
| 2026-04-11 2026 | Handlebars template injection and RCE in Shopify app intermediate 7 min read | Writeup detailing Handlebars template injection and subsequent Remote Code Execution (RCE) within Shopify's Return Magic application. The author identified an exploitable vulnerability in the Handlebars JavaScript templating engine, allowing for the injection of code. By leveraging Object.prototype.toString and the "with" helper, an attacker could potentially execute arbitrary commands on the server. |
| 2026-04-11 2026 | A Pentester's Guide to SSTI - Cobalt intermediate 3 min read RCE | Guide to Server-Side Template Injection (SSTI) detailing its nature as a vulnerability where injected input into template engines leads to command execution, often resulting in Remote Code Execution (RCE). It covers popular template engines like Smarty, Twigs, Velocity, Freemaker, JINJA, Mako, Tornado, Jade, Rage, and Liquid. The guide explains detection methods using polyglot payloads, analyzing error messages to identify engines, and exploiting vulnerabilities, mentioning the tool Tplmap for automated exploitation. Remediation strategies include sanitizing user input and employing sandboxing techniques. → cobalt.io |
| 2026-04-11 2026 | SSTI: Advanced Exploitation Guide - Intigriti advanced 9 min read RCE | Library on advanced Server-Side Template Injection (SSTI) exploitation, detailing identification and weaponization techniques. It covers various template engines including Jinja2, Twig, ERB, EJS, Handlebars, Pug, Thymeleaf, FreeMarker, Pebble, Razor, and Mako. The resource explains how to bypass sandboxed environments by chaining objects and leveraging native template engine features, offering practical examples for escalating basic injections to remote code execution. → intigriti.com |
| 2026-04-11 2026 | Exploiting Jinja SSTI with limited payload size intermediate 1 min read | Technique for exploiting Jinja Server-Side Template Injection (SSTI) with limited payload size by leveraging the globally accessible `config` object. This method involves storing payload fragments in `config` items via short URI parameters and then executing them using `popen` for remote code execution, demonstrated with a Python reverse shell. |
| 2026-04-11 2026 | RCE via SSTI in Fides Jinja Email Templates intermediate 3 min read | Library for detecting and mitigating Server-Side Template Injection (SSTI) vulnerabilities, specifically addressing a Remote Code Execution (RCE) flaw in Fides Jinja email templates. This vulnerability, GHSA-c34r-238x-f7qx, allows privileged users (Owner, Contributor, or OAuth clients with messaging-template:update scope) to inject arbitrary code via email templates. Successful exploitation can lead to RCE on the Fides Webserver container, granting unauthorized access to integrated resources and sensitive data. The issue is patched in Fides version 2.44.0. |
| 2026-04-11 2026 | CVE-2024-29178: Apache StreamPark FreeMarker SSTI news | Writeup of CVE-2024-29178, an Apache StreamPark FreeMarker Server-Side Template Injection (SSTI) leading to Remote Code Execution. This moderate-severity vulnerability allows authenticated users to exploit template injection to achieve RCE on versions prior to 2.1.4. Upgrading to Apache StreamPark 2.1.4 mitigates this risk. |
| 2026-04-11 2026 | SpringBootAdmin Thymeleaf SSTI to RCE intermediate 3 min read | Library for exploiting Thymeleaf Sandbox Bypass in Spring Boot Admin (versions <= 3.1.0) and Thymeleaf (versions <= 3.1.1.RELEASE). This vulnerability allows for Remote Code Execution (RCE) via MailNotifier configuration, enabling attackers to set a malicious remote HTML template or read local files. The library includes proof-of-concept exploit code and details the sandbox bypass technique for achieving RCE. |
| 2026-04-11 2026 | Exploiting SSTI in Thymeleaf intermediate 5 min read | Writeup detailing Server-Side Template Injection (SSTI) vulnerabilities in the Thymeleaf template engine for Java. It covers Thymeleaf's expression types, including variable expressions vulnerable to OGNL or Spring EL, and the "expression preprocessing" feature. A real-world example is demonstrated within the PetClinic application, showing how controlling the `path` variable in a specific fragment can lead to arbitrary expression execution and potentially Remote Code Execution (RCE) when running on Jetty. → acunetix.com |