We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-34906

CVE-2026-34906

Express

Severity: —
CVSS: —CVSS
Published: 2026-06-02
Last modified: 2026-06-02
CWE: CWE-1336

Description

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

References

https://cert.pl/posts/2026/06/CVE-2026-34906
https://simple.com.pl/branze/edukacyjna/

Summary

Description

References