跳转到帖子

Craft CMS Twig Template Injection RCE via FTP Templates Path

recommended_posts

发布于
  • Members

Craft CMS Twig Template Injection RCE via FTP Templates Path

Disclosed
12/19/2024
Created
01/24/2025

Description

This module exploits a Twig template injection vulnerability in Craft CMS by abusing the --templatesPath argument. The vulnerability allows arbitrary template loading via FTP, leading to Remote Code Execution (RCE).

Author(s)

  • jheysel-r7
  • Valentin Lobstein
  • AssetNote

Platform

Linux,Unix

Architectures

cmd

Development

  • Source Code
  • History
  • 查看数 702
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…