SEOmatic for CraftCMS allows Server-Side Template Injection

CRITICAL 9.8CVE-2020-9757 · GHSA-6q4j-8pjm-5mgc · Published 04/03/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
nystudio107/craft-seomatic Packagist	`< 3.3.0`	`3.3.0`
craft cms craftcms	`< 3.3.0`	`3.3.0`

Description

The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.

NVD description

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.

References

nvd.nist.gov/vuln/detail/CVE-2020-9757 · ADVISORY
nystudio107/craft-seomatic commit 65ab659 · WEB
nystudio107/craft-seomatic commit a1c2cad · WEB
giany/CVE · WEB
nystudio107/craft-seomatic · PACKAGE
nystudio107/craft-seomatic · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free