CVE-2026-34906

9.3 criticalEPSS 0.6%

Critical (9.3). EPSS 0.6% chance of exploitation in the next 30 days.

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-1336
Published: 2026-06-02
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

References

https://cert.pl/posts/2026/06/CVE-2026-34906
https://simple.com.pl/branze/edukacyjna/

Check your stack JSON