VULNERABILITY INTELLIGENCE

CVE-2025-60355

CVSS score9.8 CRITICAL
EPSS probability0.53%
CISA KEVNot currently listed
Published2025-10-28
Last modified2026-10-27
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

Weakness classification

  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Primary references