Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-34906

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Simple SA Wirtualna Uczelnia

Default version status: unaffected

  • 0 to ≤ wu#2016.437.295#0#20260327_105545affected

References