CVE-2026-34906: Server-Side Template Injection (SSTI) in Wirtualna Uczelnia

Synopsis

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia (developed by Simple SA) allows an unauthenticated remote attacker to inject arbitrary template expressions into the redirectToUrl endpoint, which the server evaluates without restriction. The vulnerability is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation gives the attacker full remote code execution on the server, including the ability to establish a reverse shell. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the service via HTTP/HTTPS from a remote host.

• AuthenticationNot required

  No credentials of any privilege level are required; the injection point is accessible to anonymous requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social-engineering step is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required to trigger template evaluation.

Blast Radius

• Attacker executes arbitrary operating-system commands on the server hosting Wirtualna Uczelnia, including spawning a reverse shell for persistent access.
• All data readable by the server process is exposed, including academic records, user credentials, and session tokens stored on or accessible from the host.
• Attacker can write, modify, or delete files and database records accessible to the server process, corrupting application data and configurations.
• Service availability is at the attacker's discretion; they can terminate processes, exhaust resources, or deploy ransomware, taking the application fully offline.