https://blog.msnieman.com/tags/ssti/Recent content in SSTI on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/redpanda/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/redpanda/A Spring Boot search page reflects user input into a Server-Side Template Injection sink, giving RCE as woodenk; a root-owned log-parser cron is then exploited via JPEG Artist metadata and XML External Entity injection to read root’s SSH key.https://blog.msnieman.com/writeups/templtrap/Thu, 02 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/templtrap/A Langflow AI server exposed on port 80 is exploited via CVE-2026-0770 (SSTI RCE) for an initial shell as karen; screen 5.0.0 setuid-root logging (CVE-2025-23395) is then abused to symlink /etc/sudoers and grant passwordless sudo.