GHSA-g7xr-v82w-qggq

Code Injection in SEOmatic

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-41749

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	nystudio107/craft-seomatic	< 3.4.11	3.4.11

Details

As written in the advisory (Markdown source, shown as plain text).

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-41749 advisory
https://github.com/nystudio107/craft-seomatic/commit/3fee7d50147cdf3f999cfc1e04cbc3fb3d9f2f7d web
https://github.com/nystudio107/craft-seomatic package
https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md web