Server-Side Template Injection
Critical · Injection
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-94
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-94
Definition
User input is evaluated inside a server template engine.
Root cause
Concatenating input into templates.
Affected components
- Components in the “Injection” class
- Application / API handlers
- Supporting libraries
Impact
RCE.
Severity
Critical
Safe lab reproduction
PortSwigger SSTI
Detection methodology
Template syntax probes.
Evidence examples
- Lab reproduction notes: PortSwigger SSTI
- Request/response excerpts (redacted)
- Detection signal: Template syntax probes
Remediation
Sandbox engines; never concat into templates.
Secure coding examples
Pass variables safely to templates.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.