Code Injection in SEOmatic

CRITICO 9.8CVE-2021-41749 · GHSA-g7xr-v82w-qggq · Published 12/06/2022 · updated 17/06/2026

In breve

CVE-2021-41749 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda nystudio107/craft-seomatic, seomatic (nystudio107).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 16.8%, superiore al 97.0% delle vulnerabilità.
Correzione: aggiornare a 3.4.11 o successiva.

Package	Affected versions	Patched versions
nystudio107/craft-seomatic Packagist	`< 3.4.11`	`3.4.11`
seomatic nystudio107	`≤ 3.4.11`	No fix yet

Description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

NVD description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

References

nvd.nist.gov/vuln/detail/CVE-2021-41749 · ADVISORY
nystudio107/craft-seomatic commit 3fee7d5 · WEB
nystudio107/craft-seomatic · PACKAGE
nystudio107/craft-seomatic · WEB

Altre vulnerabilità di nystudio107/craft-seomatic

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nystudio107/craft-seomatic

Packagist

< 3.4.11

3.4.11

seomatic

nystudio107

≤ 3.4.11

No fix yet

Description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

NVD description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

Altre vulnerabilità di nystudio107/craft-seomatic

Vedi tutto →