vulnerability

BeyondTrust: CVE-2025-5309: RCE Via Server-Side Template Injection

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:C/I:C/A:C)

Published

Jun 16, 2025

Added

Jul 21, 2025

Modified

Apr 8, 2026

Description

The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution. Remote Support and Privileged Remote Access components do not properly escape input intended for the template engine, leading to a potential template injection vulnerability.

Solutions

beyondtrust-remote-support-upgrade-latestbeyondtrust-privileged-remote-access-upgrade-latest

References

https://www.beyondtrust.com/trust-center/security-advisories/bt25-04
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18420
CVE-2025-5309
https://attackerkb.com/topics/CVE-2025-5309
CWE-94
EUVD-EUVD-2025-18420

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report