CVE-2026-34906
Server-Side Template Injection (SSTI) in Wirtualna Uczelnia
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 2, 2026
- Updated
- Jun 2, 2026
- Reserved
- Mar 31, 2026
Description
Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell.
This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L | CERT-PL |
Weaknesses
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected Products
| Product | Versions |
|---|---|
Wirtualna UczelniaSimple SA |
|
References
- https://cert.pl/posts/2026/06/CVE-2026-34906third-party-advisory
- https://simple.com.pl/branze/edukacyjna/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.