Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-cneu-aazx-byfq
Vulnerability ID VCID-cneu-aazx-byfq
Aliases CVE-2023-30179
GHSA-3x74-v64j-qc3f
Summary CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.05499 https://api.first.org/data/v1/epss?cve=CVE-2023-30179
cvssv3.1 7.2 https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
generic_textual HIGH https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
ssvc Track* https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3x74-v64j-qc3f
cvssv3.1 7.2 https://github.com/craftcms/cms
generic_textual HIGH https://github.com/craftcms/cms
cvssv3.1 7.2 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
generic_textual HIGH https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
ssvc Track* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
cvssv3.1 7.2 https://github.com/github/advisory-database/pull/2443
generic_textual HIGH https://github.com/github/advisory-database/pull/2443
cvssv3.1 7.2 https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
generic_textual HIGH https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
ssvc Track* https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
cvssv3.1 7.2 https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
generic_textual HIGH https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
ssvc Track* https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2023-30179
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-30179
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-30179
https://github.com/github/advisory-database/pull/2443
https://nvd.nist.gov/vuln/detail/CVE-2023-30179
2443#issuecomment-1610040714 https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
2443#issuecomment-1610634200 https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
CHANGELOG.md#442---2023-03-14 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
cve-2023-30179-server-side-template-injection https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
GHSA-3x74-v64j-qc3f https://github.com/advisories/GHSA-3x74-v64j-qc3f
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/craftcms/cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/pull/2443
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-30179
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.90431
EPSS Score 0.05499
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:20:08.664254+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/30xxx/CVE-2023-30179.json 38.6.0