CVE-2026-34906CWE-1336

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia

Critical · published June 2, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell.

This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00887 · 58.9th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2026-06-02T08:31Z
EPSS history
Timeline
  • 02 JUN 08:31Z
    Server-Side Template Injection (SSTI) in Wirtualna Uczelnia
    cvelistv5