SSI injection
Summary: Server-Side Include (SSI) injection vulnerabilities arise when an application incorporates user-controllable data into a response that is then parsed for SSI directives, and without strict validation an attacker can modify or inject directives. PortSwigger notes these flaws can typically inject arbitrary content including JavaScript with the same impact as cross-site scripting, and depending on server configuration may also allow reading protected files or arbitrary code execution with the same impact as OS command injection.
Bottom line: A single unvalidated input on an SSI-parsed page can escalate from injected JavaScript to reading protected files or running code on the server, depending on how that server is configured.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026