CVE-2026-34906

Vulnerability

Server-Side Template Injection (SSTI) exists in Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545 [2]. The vulnerability resides in the redirectToUrl endpoint and the redirectUrlParameter parameter, where insufficient input validation allows an attacker to inject arbitrary template expressions that are then executed on the server [2].

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious request targeting the redirectToUrl endpoint and providing a specially designed payload within the redirectUrlParameter. This payload will contain template expressions that, when processed by the server, lead to code execution [2]. No specific user interaction or special privileges are required for exploitation.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve Remote Code Execution (RCE) on the server [2]. This can include the ability to run arbitrary commands, potentially leading to the establishment of a reverse shell, granting the attacker significant control over the affected system.

Mitigation

This vulnerability affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545 [2]. A patch or updated version addressing this issue has not yet been disclosed in the available references. Users are advised to monitor for updates from the vendor.