SSTI leads to Command injection
HackerOnecurl2026-03-04
Web
Not rated
BUG BOUNTY WRITEUPS
Server-side template injection writeups
Template engines evaluating user input, from simple expression probes to full RCE.
8 reports and writeups from 2024 to 2026. 3 carry a severity from the disclosing platform, 3 of them rated High or Critical. Last updated 2026-10-30.
Latest Server-side template injection reports
Search and filter all writeupsManagement Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection
HackerOneGitHub2024-09-13
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forward
HackerOneGitHub2024-09-13
Web
High
Web
Not rated
WPML Multilingual CMS Authenticated Contributor+ Remote Code Execution (RCE) via Twig Server-Side Template Injection (SSTI)
Researcher blogWordfence2024-08-21$1,639 bounty
Web, Source Code
Not rated
Chaining Three Bugs to Access All Your ServiceNow Data
Researcher blogServiceNow2024-07-11
Web, Source Code
Not rated
CVE-2024-27292: docAssembling exploits for RCE
Researcher blogDocassemble2024-07-01
Web
Not rated
Client Side Template Injection to Stored XSS in Image Collection
HackerOneMars2024-02-14
Web
High
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.