Server-side template injection
Summary: Server-side template injection occurs when user input is unsafely embedded into a server-side template, letting an attacker inject template directives that may execute arbitrary code and take full control of the web server. PortSwigger notes that exploitability varies widely by template engine, ranging from trivial to almost impossible, and that some instances pose no significant security risk.
What you should know: A successful injection can mean complete compromise of the application's data and functionality, and often of the host server itself, which can then be used as a platform for further attacks against other systems.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026