CVE-2026-34906

Vulnerability Description

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

Related Weaknesses (CWE)

References

• https://cert.pl/posts/2026/06/CVE-2026-34906
• https://simple.com.pl/branze/edukacyjna/

FAQ

What is CVE-2026-34906?

CVE-2026-34906 is a documented vulnerability. Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter,...

How severe is CVE-2026-34906?

CVSS scoring is not yet available for CVE-2026-34906. Check NVD for updates.

Is there a patch for CVE-2026-34906?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.