module
Craft CMS Twig Template Injection RCE via FTP Templates Path
Disclosed |
---|
Dec 19, 2024 |
Disclosed
Dec 19, 2024
Description
This module exploits a Twig template injection vulnerability in Craft CMS by abusing the --templatesPath argument.
The vulnerability allows arbitrary template loading via FTP, leading to Remote Code Execution (RCE).
The vulnerability allows arbitrary template loading via FTP, leading to Remote Code Execution (RCE).

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.