Server-side template injection
Summary: PortSwigger Research first documented server-side template injection in a 2015 paper and conference presentation, describing it as an attacker using native template syntax to inject a malicious payload into a template that is then executed server-side. The flaw arises when user input is concatenated directly into a template rather than passed in as data, and at the severe end an attacker can achieve remote code execution and take full control of the back-end server.
What you should know: PortSwigger notes these vulnerabilities often go unnoticed not because they are complex but because they are only apparent to auditors explicitly looking for them, and that once detected they can be surprisingly easy to exploit, especially in unsandboxed environments. The recommended fix is to allow no users to modify or submit templates, which business requirements sometimes make unavoidable.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026