Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e4ax-kekp-xud6
Vulnerability ID VCID-e4ax-kekp-xud6
Aliases CVE-2023-30179
GHSA-3x74-v64j-qc3f
Summary Improper Control of Generation of Code ('Code Injection') CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
epss 0.05499 https://api.first.org/data/v1/epss?cve=CVE-2023-30179
cvssv3.1 7.2 https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
generic_textual HIGH https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
ssvc Track* https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3x74-v64j-qc3f
cvssv3.1 7.2 https://github.com/craftcms/cms
generic_textual HIGH https://github.com/craftcms/cms
cvssv3.1 7.2 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
generic_textual HIGH https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
ssvc Track* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
cvssv3.1 7.2 https://github.com/github/advisory-database/pull/2443
generic_textual HIGH https://github.com/github/advisory-database/pull/2443
cvssv3.1 7.2 https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
generic_textual HIGH https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
ssvc Track* https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
cvssv3.1 7.2 https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
generic_textual HIGH https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
ssvc Track* https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2023-30179
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-30179
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-30179
https://github.com/craftcms/cms
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
https://github.com/github/advisory-database/pull/2443
https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
CVE-2023-30179 https://nvd.nist.gov/vuln/detail/CVE-2023-30179
CVE-2023-30179-SERVER-SIDE-TEMPLATE-INJECTION https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
GHSA-3x74-v64j-qc3f https://github.com/advisories/GHSA-3x74-v64j-qc3f
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/craftcms/cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/pull/2443
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-03T20:04:19Z/ Found at https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-30179
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.90367
EPSS Score 0.05499
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:00:49.632497+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/craftcms/cms/CVE-2023-30179.yml 38.6.0