Template Injection Research | Port Swigger Research
Summary: PortSwigger Research describes template injection, where user input is allowed to define template expressions, split into client-side template injection (CSTI) in the browser and HTML and server-side template injection (SSTI) in server languages such as PHP and engines such as Twig. PortSwigger says it discovered the SSTI technique in 2015, presented DOM Based Angular Sandbox Escapes at BSides Manchester in 2017 and Server-Side Template Injection: RCE for the Modern Webapp at Black Hat USA, and that some engines use sandboxes to block access to the filesystem or arbitrary code execution.
Bottom line: SSTI typically carries greater impact than CSTI because successful exploitation can often lead to Remote Code Execution, and the Black Hat presentation led to a flood of high impact bug bounty reports from PortSwigger and the community.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026