The newest Server-Side Template Injection (SSTI) resources are on the Server-Side Template Injection (SSTI) page. For a reading order instead of a date order, see the Server-Side Template Injection (SSTI) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-11 2026 | Exploiting SSTI in a Modern Spring Boot Application intermediate 5 min read | Library for exploiting Server-Side Template Injection (SSTI) in modern Spring Boot applications, specifically targeting bypasses in newer versions. It details how to identify SSTI via Referer header reflection, overcome HTML encoding defenses, and achieve Remote Code Execution (RCE) by leveraging `org.apache.commons.lang3.reflect.MethodUtils` to circumvent Thymeleaf's built-in denylists and achieve arbitrary method execution on `java.lang.Runtime`. |
| 2026-04-11 2026 | Method Confusion in Go SSTIs Lead to RCE advanced 3 min read | Library for Go Server-Side Template Injection (SSTI) research, detailing method confusion vulnerabilities in the `html/template` and `text/template` modules. It demonstrates how to achieve Remote Code Execution (RCE) and file read capabilities by calling exported methods with controlled parameters, offering a new avenue for exploitation beyond simple XSS. Specific examples include leveraging the `Person.Secret` method for command execution and the `echo.Context.File` method for local file reading. → onsecurity.io |
| 2026-04-11 2026 | Exploiting SSTI in Golang Frameworks intermediate 5 min read | Writeup exploring Server-Side Template Injection (SSTI) in Golang frameworks like Gin, Echo, and Fiber. It details how attackers can exploit template engines by traversing objects to achieve remote code execution. Specific techniques and payloads are demonstrated for arbitrary file reading using Echo's `.File` and `.Attachment` gadgets, Cross-Site Scripting via Gin's context, and Denial of Service through Fiber's `.App.Shutdown`. |
| 2026-04-11 2026 | Golang SSTI: Safe by Default or Vulnerable by Design intermediate 4 min read | Library that detects and prevents Golang Server-Side Template Injection (SSTI) vulnerabilities by observing template execution at runtime. It leverages Deep Application Inspection (DAI) to provide application execution context, a template-aware syscall map, and rich context, offering zero-day coverage for "shadow" vulnerabilities. This approach goes beyond traditional defenses like EDRs, CWPPs, and WAFs by identifying malicious behavior at its origin before it propagates, protecting against exploitation of Go’s standard `text/template` and `html/template` engines through context-unaware execution, logic helper functions, and error channel leaks. |
| 2026-04-11 2026 | SSTI: Transforming Web Apps from Assets to Liabilities beginner 12 min read | Library for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. It details risks such as arbitrary code execution and data theft, noting real-world impacts on platforms like Atlassian Confluence and CrushFTP. The library covers techniques including fuzzing, blind SSTI detection using `sleep` commands, and `nslookup` for DNS-based validation, applicable to template engines like Jinja2, Freemarker, and Twig. |
| 2026-04-11 2026 | ServiceNow RCE Exploitation Campaign intermediate 6 min read | Writeup detailing a global reconnaissance campaign exploiting ServiceNow vulnerabilities CVE-2024-4879 and CVE-2024-5217. The campaign leveraged chained title injection, template injection bypass, and filesystem filter bypass to achieve unauthenticated remote code execution. Attackers utilized tools like Nuclei and search engines such as FOFA, Shodan, and HUNTER.NOW for reconnaissance and exploitation, aiming to exfiltrate database contents and user credentials from vulnerable instances across various industries, including financial services. → resecurity.com |
| 2026-04-11 2026 | Multiple ServiceNow SSTI Vulnerabilities intermediate 1 min read | Writeup of multiple ServiceNow Server-Side Template Injection (SSTI) vulnerabilities, including CVE-2024-4879 (CVSS 9.3), CVE-2024-5178 (CVSS 6.9), and CVE-2024-5217 (CVSS 9.2), affecting non-hosted instances of Vancouver, Washington DC, and Utah releases. Exploitation allows arbitrary code execution, leading to potential system compromise and data theft. Proof-of-concept code is available on GitHub, and these are CISA Known Exploited Vulnerabilities. Patches are available, and hosted instances were automatically updated. |
| 2026-04-11 2026 | ServiceNow RCE (CVE-2024-4879) Analysis news 4 min read | Analysis of CVE-2024-4879 details a critical Jelly template injection vulnerability in ServiceNow, enabling unauthenticated remote code execution. This flaw allows attackers to inject and execute arbitrary code, posing risks of unauthorized data access, system compromise, and service disruption. Public exploit tools exist, and the vulnerability has been actively used in attacks with low complexity. Affected ServiceNow versions require immediate patching, and robust input validation is advised as mitigation. |
| 2026-04-11 2026 | SSTI in Jinja2 allows RCE (changedetection.io) intermediate 1 min read | Writeup of GHSA-4r7v-whpg-8rx3 in changedetection.io details a critical Server Side Template Injection vulnerability within Jinja2 usage, allowing Remote Command Execution. Exploitation involves crafting a malicious notification body payload such as `{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}` to execute arbitrary system commands, potentially leading to complete server takeover. The vulnerability affects changedetection.io version 0.45.20 and is exacerbated by the lack of default authentication enforcement. |
| 2026-04-11 2026 | CVE-2025-23211: Jinja2 SSTI Turns Recipes Into RCE news 3 min read | Writeup of CVE-2025-23211 in Tandoor Recipes, detailing how Server-Side Template Injection (SSTI) via the Jinja2 engine allows for Remote Code Execution (RCE). This vulnerability arises from trusting user input directly within templates, enabling attackers to inject commands and potentially compromise the server, steal data, and pivot within a network. |
| 2026-04-11 2026 | CVE-2025-23211: Tandoor Recipes Jinja2 SSTI to RCE news 2 min read | Writeup of CVE-2025-23211, a critical Jinja2 Server-Side Template Injection (SSTI) vulnerability in Tandoor Recipes versions prior to 1.5.24. This flaw allows authenticated users to execute arbitrary system commands on the server by injecting malicious Jinja2 expressions into recipe instructions. In Docker Compose deployments, this can lead to root-level system compromise. Mitigation involves upgrading to version 1.5.24, implementing strict input validation, and adhering to the principle of least privilege. |
| 2026-04-10 2026 | GoSecure: Template Injection in Action workshop beginner 11 min read | Workshop slides from GoSecure presenting a 2-hour deep dive into Template Injection, also known as Server-Side Template Injection (SSTI). This workshop, built on foundations established by James Kettle's 2015 Black Hat talk, features six labs exploring exploitation techniques against five distinct template engines, including Twig and Jinja. Participants will learn to identify vulnerabilities by understanding template syntax, leverage internal APIs like Twig's `_self.env.registerUndefinedFilterCallback` for command execution, and exploit Python's Jinja metaproperties to enumerate classes and potentially achieve code execution. The labs are containerized using Docker for easy deployment, and an HTTP interception proxy is the only prerequisite. |
| 2026-04-10 2026 | Jinja2 SSTI filter bypasses intermediate | Jinja2 SSTI filter bypasses |
| 2026-04-10 2026 | OnSecurity: Server Side Template Injection with Jinja2 beginner 10 min read | Library detailing Server-Side Template Injection (SSTI) vulnerabilities within Jinja2, focusing on Python environments. It explains template rendering and abuses the Method Resolution Order (MRO) to execute arbitrary code, including techniques for bypassing filters that block common characters like periods and underscores. The resource also explores alternative payload delivery mechanisms using Jinja2's `{% %}` syntax for conditional statements, enabling blind SSTI exploitation and data exfiltration via HTTP. → onsecurity.io |
| 2026-04-10 2026 | Flask & Jinja2 SSTI cheatsheet beginner 5 min read | Cheatsheet detailing Server-Side Template Injection (SSTI) specifically for Flask and Jinja2, covering reconnaissance techniques like probing `{{7*'7'}}`, basic exploitation using `__mro__` and `__subclasses__` to access Python objects, identifying sinks like `flask.render_template_string`, leveraging global variables (`config`, `request`, `session`), and performing arbitrary file reads or remote code execution. It also includes methods for bypassing filters using techniques like `|attr()` and string concatenation, and mentions tools like Tplmap and search.py. |
| 2026-04-10 2026 | Grav: SSTI via Twig escape handler advisory news 2 min read | Advisory on GHSA-2m7x-c7px-hp58 details a Server-Side Template Injection (SSTI) vulnerability in Grav via Twig's `setEscaper` function. Exploitation allows attackers to redefine the escape function and execute arbitrary commands by gaining unrestricted access to Twig extension classes, particularly when Grav's Twig sandbox feature is not enabled. This can lead to arbitrary code execution and privilege escalation. |
| 2026-04-10 2026 | Exploit-DB: Twig 2.4.4 Server Side Template Injection intermediate | Writeup of Twig <2.4.4 Server Side Template Injection, an SSTI vulnerability allowing command execution via template parameters. Attackers can inject code like `{{ls}}` into parameters, bypassing expected values to run arbitrary commands, as demonstrated by injecting `{{4*4}}` to return `16`. → exploit-db.com |
| 2026-04-10 2026 | OpenMetadata: FreeMarker SSTI in email templates leads to RCE intermediate 4 min read RCE | Library detailing a critical Remote Code Execution (RCE) vulnerability (GHSA-5f29-2333-h9c7) in OpenMetadata v1.11.2. This vulnerability arises from Server-Side Template Injection (SSTI) in FreeMarker email templates, allowing an administrator to inject malicious FreeMarker code. This code is then executed by the server when specific email notifications are triggered, enabling arbitrary command execution, data exfiltration, and privilege escalation. |
| 2026-04-10 2026 | CVE-2023-49964: FreeMarker SSTI in Alfresco news | Writeup detailing CVE-2023-49964, a FreeMarker Server-Side Template Injection (SSTI) vulnerability in Hyland Alfresco Community Edition <=7.2.0. Exploitation involves injecting malicious content into `folder.get.html.ftl` to achieve Remote Code Execution (RCE) by leveraging exposed FreeMarker objects. This vulnerability builds upon work related to CVE-2020-12873 and inspired by SSTI research from PortSwigger and Synacktiv. |
| 2026-04-10 2026 | GitHub Security Lab: SSTI in Apache Camel — CVE-2020-11994 news 4 min read | Writeup on CVE-2020-11994, detailing Server-Side Template Injection (SSTI) vulnerabilities in Apache Camel's FreeMarker, Velocity, MVEL, and Mustache components. These flaws enable Remote Code Execution (RCE) and Arbitrary File Disclosure by allowing attackers to control template headers or resource URIs, potentially impacting versions 2.x up to 2.22.0 and 3.x up to 3.2.0. → securitylab.github.com |
| 2026-04-10 2026 | Breaking the Barrier: RCE via SSTI in FreeMarker intermediate | Breaking the Barrier: RCE via SSTI in FreeMarker |
| 2026-04-10 2026 | Synack: Discovering an SSTI vulnerability in FreeMarker intermediate 5 min read | Writeup detailing a Server-Side Template Injection (SSTI) vulnerability in FreeMarker, identified as a path to Remote Code Execution (RCE). The entry highlights how user input can be exploited within template engines when not properly validated, leading to arbitrary code execution. It further details a specific bypass technique using FreeMarker's `?lower_abc` and `?upper_abc` functions to circumvent wordlist-based filters and achieve RCE by encoding malicious payloads. |
| 2026-04-10 2026 | YesWeHack: Limitations are just an illusion — advanced SSTI exploitation with RCE everywhere advanced 7 min read RCE | Writeup detailing advanced Server-Side Template Injection (SSTI) exploitation techniques, demonstrating Remote Code Execution (RCE) without relying on quotes or external plugins across Jinja2, Mako, Twig, Smarty, Blade, Groovy, FreeMarker, and Razor template engines. It showcases how to leverage built-in functions like `chr`, `popen`, `passthru`, and `implode`, along with engine-specific features like Python's `__init__.__globals__` or Twig's block functionality, to bypass auto-escaping and achieve RCE in diverse application security contexts. → yeswehack.com |
| 2026-04-10 2026 | vladko312/SSTImap: Automatic SSTI detection tool with interactive interface intermediate 6 min read | Tool for automatic Server-Side Template Injection (SSTI) detection and exploitation, inspired by Tplmap. SSTImap supports various template engines including Java, JavaScript, PHP, Python, and Ruby, and can exploit code context escapes and blind injection scenarios. It offers interactive mode for easier exploitation and detection, supports eval()-like code injections, and provides capabilities for OS command execution, file system manipulation, and code evaluation. New techniques and payloads, drawing from research by James Kettle and others, enhance its ability to identify and leverage SSTI vulnerabilities. |
| 2026-04-10 2026 | epinna/tplmap: SSTI and Code Injection Detection and Exploitation Tool intermediate 2 min read | Tool for detecting and exploiting Server-Side Template Injection (SSTI) and code injection vulnerabilities. Tplmap assists in gaining operating system access through sandbox escape techniques, supporting Python, Ruby, PHP, and Java eval()-like injections across over 15 template engines, including Jinja2. It offers capabilities for shell command execution, bind and reverse shells, file upload/download, and code evaluation. |
| 2026-04-10 2026 | PayloadsAllTheThings SSTI: Java intermediate 5 min read | Library cataloging common Java Server-Side Template Injection (SSTI) payloads across various templating engines. This resource details exploit techniques for JSP, Thymeleaf, FreeMarker, Jinjava, Pebble, and Velocity. It includes specific payload examples for command execution, demonstrating how to leverage Expression Languages, built-in functions like `lower_abc` in FreeMarker, and dynamic class loading in engines like Jinjava and Pebble to achieve Remote Code Execution (RCE). |
| 2026-04-10 2026 | PayloadsAllTheThings: Server Side Template Injection beginner 4 min read | Library providing resources on Server-Side Template Injection (SSTI). It details techniques like Rendered, Error-Based, Boolean-Based, and Time-Based exploitation, and references tools such as Hackmanit/TInjA and epinna/tplmap. The library includes information on identifying template engines like Jinja2, Twig, and FreeMarker, and discusses specific research papers on SSTI detection and exploitation. |
| 2026-04-10 2026 | HackTricks: Jinja2 SSTI intermediate 8 min read | Library detailing Jinja2 Server-Side Template Injection (SSTI) vulnerabilities, including techniques for escaping sandboxes to access regular Python execution flow. It demonstrates methods to recover the `<class 'object'>` from accessible objects like `dict`, `request`, and `config`, enabling the retrieval of subclasses. This allows for operations such as reading and writing remote files using the `File` class, and executing arbitrary commands via `subprocess.Popen`. The library also covers techniques for abusing statement tags like `{% with %}` and `{% if %}` when `{{ ... }}` is blocked. → book.hacktricks.xyz |
| 2026-04-10 2026 | HackTricks: SSTI (Server Side Template Injection) beginner | HackTricks: SSTI (Server Side Template Injection) → book.hacktricks.xyz |
| 2026-04-10 2026 | OWASP Testing for Server Side Template Injection beginner 3 min read | Reference for testing Server-Side Template Injection (SSTI) vulnerabilities in web applications, a common flaw found when user input is unsafely embedded in templating engines like Jinja2 and Twig, potentially leading to remote code execution. The guide details methods for detecting injection points, identifying templating engines, and building exploits, referencing tools such as Tplmap and Burp Suite extensions. It also covers testing in both plaintext and code contexts. → owasp.org |
| 2026-04-10 2026 | Server-side template injection PortSwigger KB intermediate 1 min read | Library detailing Server-side template injection, a vulnerability where user input is unsafely embedded into server-side templates, potentially allowing arbitrary code execution and server control. It covers identifying template engine types, mapping the attack surface, and auditing exposed objects, noting severity varies by engine. Remediation strategies include avoiding user-generated templates, using logic-less engines like Mustache, or sandboxing rendering environments. This vulnerability is classified under CWE-94, CWE-95, and CWE-116, often carrying a high severity. → portswigger.net |
| 2026-04-10 2026 | Exploiting server-side template injection vulnerabilities intermediate 5 min read | Reference detailing the exploitation of server-side template injection vulnerabilities, covering techniques for discovering and leveraging template engine syntax and documentation, including examples with Mako, ERB, and Velocity. It emphasizes reading documentation, identifying syntax, exploring environment objects like "self," analyzing developer-supplied objects, and constructing custom exploits through object chaining to achieve outcomes ranging from remote code execution to file path traversal. → portswigger.net |
| 2026-04-10 2026 | Template Injection Research | PortSwigger Research advanced 2 min read | Library covering template injection, detailing both Client Side Template Injection (CSTI) and Server Side Template Injection (SSTI). Learn techniques to bypass Content Security Policy (CSP) and exploit client-side vulnerabilities similar to Cross-Site Scripting (XSS), including breaking the AngularJS sandbox as presented at BSides Manchester. Explore server-side exploitation, detecting templating engines, and achieving Remote Code Execution (RCE), including research presented at Black Hat USA on SSTI. → portswigger.net |
| 2026-04-10 2026 | Server-Side Template Injection | PortSwigger Research advanced 18 min read | Reference for Server-Side Template Injection (SSTI) details a methodology for detecting and exploiting template engines like Twig and FreeMarker, which are commonly used to embed dynamic content. SSTI vulnerabilities arise when user input is unsafely embedded in templates, potentially leading to Remote Code Execution (RCE). The research outlines detection techniques for both "text" and "variable" contexts, emphasizing the importance of identifying the specific template engine and its documentation to craft effective exploits, including escaping sandbox modes. → portswigger.net |
| 2026-04-10 2026 | Server-side template injection | Web Security Academy beginner 8 min read | Library explaining server-side template injection, a vulnerability where attackers inject malicious payloads into templates to achieve remote code execution or access sensitive data. It details how these vulnerabilities arise when user input is directly concatenated into templates instead of being passed as data, and outlines detection methods like fuzzing with special characters and testing mathematical operations in plaintext or code contexts, applicable to engines like Twig and Freemarker. → portswigger.net |