Lab: Server-side template injection with a custom exploit
Summary: PortSwigger's lab demonstrates server-side template injection through the blog-post-author-display parameter in a POST request for changing a preferred name, where an arbitrary file can be set as the avatar and rendered by viewing a test comment. The lab requires building a custom exploit to delete /.ssh/id_rsa from Carlos's home directory, and notes that careless method invocation can damage the lab instance, requiring a 20-minute wait for the session to reset.
Bottom line: The lab's own warning that a careless method call can break the instance and force a 20-minute reset illustrates how little separation exists between a template injection foothold and destructive action on the host.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026