CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2018-14716
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
Severity
- EPSS
- 33% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nystudio107:seomatic
References
- http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic/
- https://github.com/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f2749110508d1ce1
- https://github.com/nystudio107/craft-seomatic/releases/tag/3.1.4
- https://twitter.com/nystudio107/status/1021847835418009605
- https://twitter.com/nystudio107/status/1021855169515057152