SEOmatic plugin for Craft CMS SSTI Vulnerability

ALTO 7.5CVE-2018-14716 · GHSA-6j9m-rp7m-3gfg · Published 06/08/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
nystudio107/craft-seomatic Packagist	`< 3.1.4`	`3.1.4`
seomatic nystudio107	`< 3.1.4`	`3.1.4`

Description

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-14716 · ADVISORY
nystudio107/craft-seomatic commit 1e7d1d0 · WEB
nystudio107/craft-seomatic · PACKAGE
nystudio107/craft-seomatic release 3.1.4 · WEB
twitter.com/nystudio107/status/1021847835418009605 · WEB
twitter.com/nystudio107/status/1021855169515057152 · WEB
exploit-db.com/exploits/45108 · WEB
ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic · WEB
ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic · Third Party Advisory
exploit-db.com/exploits/45108 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free