# Server-side template injection

User input parsed as template source or evaluated expression instead of passed as data

_Area: Web injection and code execution. Seen in 8 disclosed reports; 6 confirmed bounties, median $6,250, range $1,639-$23,000; latest 2025-05-20. Updated 2026-10-23._

## How it works
A template engine parses its input as code: it resolves expressions and calls functions. The safe pattern passes user data as a context variable into a fixed template. The unsafe pattern builds the template string from user input, or hands user input to an evaluator (Twig, Jinja2, SpEL/EL, AMPScript, or a library attribute parser). The broken assumption is that "it's just a template" means "it's just text." Once input is parsed as template source, the engine's expression syntax and function library become the attacker's language, running with the server's privileges [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-how-an-obscure-php-footgun-led-to-rce-in-craft-cms.md)[E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-01-14-gaining-access-to-ubers-user-data-through-ampscript-evaluation.md)[E4](https://bugbountylibrary.com/r/blog%3Asec-stealthcopter-com-wpml-rce-via-twig-ssti.md)[E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428.md)[E7](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200929023045-https-www-mohamedharon-com-2018-01-rce-vulnerabilite-in-yahoo-subdomain-html.md)[E8](https://bugbountylibrary.com/r/h1%3A125980.md).

SSTI is server-side evaluation of template syntax, distinct from XSS/HTML injection where input is reflected into markup a browser renders. The two blur when a rendering library both parses markup and evaluates attributes [E3](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md).

## Where it shows up
- User fields concatenated into a template string before render instead of passed as context [E8](https://bugbountylibrary.com/r/h1%3A125980.md).
- Shortcode/plugin callbacks that render user-supplied content as a template [E4](https://bugbountylibrary.com/r/blog%3Asec-stealthcopter-com-wpml-rce-via-twig-ssti.md).
- Vendor marketing/email endpoints evaluating personalization fields in the vendor's scripting language [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-01-14-gaining-access-to-ubers-user-data-through-ampscript-evaluation.md).
- Framework message/error resolution evaluating a user-controlled format or parameter (Spring EL) [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428.md)[E7](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200929023045-https-www-mohamedharon-com-2018-01-rce-vulnerabilite-in-yahoo-subdomain-html.md).
- Library attribute evaluators that eval a value, e.g. ReportLab color parsing [E3](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md).
- CLI detection via `isset($_SERVER['argv'])` where query-string tokens become flags and control template paths [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-how-an-obscure-php-footgun-led-to-rce-in-craft-cms.md).
- A translation pass that runs after template render, so injected `[[...]]` is evaluated late [E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-eight-high-severity-vulnerabilities-nodebb.md).

## How to review
Trace every user-controlled value to the template engine. The invariant: user input must only ever be a context variable, never part of the template source or an evaluated expression. Confirm render calls take a constant template plus a data map. For evaluators, confirm the value is parsed as data (quoted, typed), not as code. For CLI detection, verify `PHP_SAPI` rather than `argv` presence, and confirm `register_argc_argv` cannot be fed from the query string [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-how-an-obscure-php-footgun-led-to-rce-in-craft-cms.md). For framework message resolution, confirm user input is a message argument, not the format string [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428.md)[E7](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200929023045-https-www-mohamedharon-com-2018-01-rce-vulnerabilite-in-yahoo-subdomain-html.md). For translation passes, confirm escaping happens after all evaluation stages [E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-eight-high-severity-vulnerabilities-nodebb.md).

## Variants seen
- Twig SSTI via plugin shortcode content [E4](https://bugbountylibrary.com/r/blog%3Asec-stealthcopter-com-wpml-rce-via-twig-ssti.md).
- Twig injection via attacker-controlled template path from argv flags [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-how-an-obscure-php-footgun-led-to-rce-in-craft-cms.md).
- Jinja2 SSTI in email generation [E8](https://bugbountylibrary.com/r/h1%3A125980.md).
- AMPScript evaluation on a vendor preview endpoint [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-01-14-gaining-access-to-ubers-user-data-through-ampscript-evaluation.md).
- SpEL/EL injection in error pages and validators [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428.md)[E7](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200929023045-https-www-mohamedharon-com-2018-01-rce-vulnerabilite-in-yahoo-subdomain-html.md).
- Python `eval` inside a rendering library attribute [E3](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md).
- Late translation pass evaluating injected markup [E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-eight-high-severity-vulnerabilities-nodebb.md).

## Why fixes fail
Character/quote filtering and restricted-eval sandboxes are routinely bypassed; filtering the obvious syntax does not remove the evaluation sink [E3](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md)[E4](https://bugbountylibrary.com/r/blog%3Asec-stealthcopter-com-wpml-rce-via-twig-ssti.md).

## Impact and severity
Pre-auth reachable RCE in several cases [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-how-an-obscure-php-footgun-led-to-rce-in-craft-cms.md)[E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428.md)[E7](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200929023045-https-www-mohamedharon-com-2018-01-rce-vulnerabilite-in-yahoo-subdomain-html.md), data exfiltration of user records [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-01-14-gaining-access-to-ubers-user-data-through-ampscript-evaluation.md), and code execution from Contributor+ accounts [E4](https://bugbountylibrary.com/r/blog%3Asec-stealthcopter-com-wpml-rce-via-twig-ssti.md). Severity rises when the sink is reachable pre-auth, when the engine exposes filesystem/network functions, and when sandbox bypasses exist.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-how-an-obscure-php-footgun-led-to-rce-in-craft-cms.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-01-14-gaining-access-to-ubers-user-data-through-ampscript-evaluation.md
- E3: https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md
- E4: https://bugbountylibrary.com/r/blog%3Asec-stealthcopter-com-wpml-rce-via-twig-ssti.md
- E5: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-eight-high-severity-vulnerabilities-nodebb.md
- E6: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428.md
- E7: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200929023045-https-www-mohamedharon-com-2018-01-rce-vulnerabilite-in-yahoo-subdomain-html.md
- E8: https://bugbountylibrary.com/r/h1%3A125980.md