vulns.co
/
mcp by GKData.io

Back to Gadgets

Server-side template evaluation

User input lands in Jinja, Twig, Freemarker, Thymeleaf, Liquid, Pug, or similar and comes back evaluated. The gadget is the evaluation, not a reverse shell.

Tags: ssti, rce, template

Typical severity: P1-P3

What it becomes

A reflection that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with a harmless arithmetic or unique marker first.

Where to look

  • error pages
  • email templates
  • PDF/HTML renderers
  • notification titles
  • search snippets
  • preview endpoints

Chains

  • RCE: Engine exposes a sandbox escape or a known gadget (Jinja __class__, Freemarker Execute). Stop at the primitive unless the program allows a bounded proof.
  • SSRF / file read: Template includes or fetch helpers that take a URL or path from the same input.
  • XSS: If evaluation is client-side (Mustache in the browser) it is XSS, not SSTI. Name it correctly.

Notes

  • Use a unique arithmetic or a callback-only include. Do not cat /etc/passwd as the first step.
  • Client-side template injection is a different report (DOM XSS).

Back to Gadgets