Code Injection in SEOmatic

심각 9.8CVE-2021-41749 · GHSA-g7xr-v82w-qggq · Published 12/06/2022 · updated 17/06/2026

요약

CVE-2021-41749은(는) nystudio107/craft-seomatic, seomatic (nystudio107)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 16.8%, 전체 취약점의 97.0%보다 높음.
조치: 3.4.11 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
nystudio107/craft-seomatic Packagist	`< 3.4.11`	`3.4.11`
seomatic nystudio107	`≤ 3.4.11`	No fix yet

Description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

NVD description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

References

nvd.nist.gov/vuln/detail/CVE-2021-41749 · ADVISORY
nystudio107/craft-seomatic commit 3fee7d5 · WEB
nystudio107/craft-seomatic · PACKAGE
nystudio107/craft-seomatic · WEB

nystudio107/craft-seomatic의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nystudio107/craft-seomatic

Packagist

< 3.4.11

3.4.11

seomatic

nystudio107

≤ 3.4.11

No fix yet

Description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

NVD description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

nystudio107/craft-seomatic의 다른 취약점

모두 보기 →