Server-Side Template Injection

CERT Polska says Simple SA Wirtualna Uczelnia contains a Server-Side Template Injection in the redirectToUrl endpoint via the redirectUrlParameter parameter, allowing an unauthenticated attacker to get remote code execution, including a reverse shell. The advisory states all versions up to and including wu#2016.437.295#0#20260327_105545 are affected; the same notice also ties the flaw to CWE-1336 and dates disclosure to 2026-06-02.

There is no official vendor or authority CVSS baseline here, so this is a first-pass field assessment. In practice this behaves like a near-critical bug because it is pre-auth network RCE on a web app meant for student self-service, but it stays at HIGH instead of CRITICAL because the exposed population is comparatively niche, we found no KEV listing, no public PoC, and no public mass-exploitation telemetry as of 2026-06-02.

Why this verdict

• Starts near critical: pre-auth, network-reachable SSTI that CERT Polska says can become full RCE including a reverse shell.
• Adjusted down for population: this is not a ubiquitous edge product; it is a higher-education portal with a meaningfully smaller reachable population than mainstream VPNs, firewalls, mail gateways, or hypervisors.
• Adjusted down for threat evidence: as of 2026-06-02 there is no KEV entry, no public PoC, and no independently verified mass-scanning telemetry, so urgency is driven by exploitability and impact, not by observed attacker momentum.

Why not higher?

If this were a mass-deployed edge product with confirmed exploitation or even a public one-click PoC, the same pre-auth RCE mechanics would justify CRITICAL. The limiting factor is not the bug's power; it is the narrower exposure base and the absence of strong real-world exploitation signals today.

Why not lower?

Dropping this to MEDIUM would ignore the main fact pattern: unauthenticated server-side code execution on a web endpoint. Even for a niche product, pre-auth RCE on an externally reachable business application is an enterprise-grade incident path, not routine backlog material.

1. Block direct access to vulnerable portals — Put Wirtualna Uczelnia behind VPN, IP allowlists, or an authenticated access proxy within 30 days. This is the highest-value exposure reduction because it removes the unauthenticated internet attacker position that makes this flaw dangerous.
2. Create a WAF rule for redirectToUrl abuse — Deploy request filtering for the redirectToUrl endpoint and aggressively inspect redirectUrlParameter for template-expression metacharacters and obvious command-execution payloads within 30 days. This will not be perfect, but it can cut commodity exploitation and buy patching time.
3. Constrain egress from app servers — Restrict outbound traffic from the application tier to only required destinations within 30 days. That directly frustrates reverse shells, second-stage payload retrieval, and low-effort C2 even if initial code execution succeeds.
4. Tune EDR for web-to-shell behavior — Add high-priority detections for web server or Java worker processes spawning cmd, powershell, sh, bash, curl, wget, nc, or scripting interpreters within 30 days. This is the control most likely to catch the post-exploitation stage when prevention fails.
5. Hunt for redirectToUrl anomalies — Review access logs and WAF/proxy telemetry for unusual requests to redirectToUrl, oversized or encoded redirectUrlParameter values, and follow-on shell/network behaviors within 30 days. The endpoint name is known, which gives defenders a focused hunt surface.

Run this from an auditor workstation with Python 3, or from the target host if that is easier. Invoke it as python3 verify_wu_cve_2026_34906.py --url https://portal.example.edu/ to try passive version extraction from HTTP responses, or python3 verify_wu_cve_2026_34906.py --version 'wu#2016.437.295#0#20260327_105545' if you already know the deployed build; no admin privileges are required.

#!/usr/bin/env python3
# verify_wu_cve_2026_34906.py
# Passive verifier for CVE-2026-34906 (Wirtualna Uczelnia SSTI)
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

import argparse
import re
import sys
from urllib.request import Request, urlopen
from urllib.error import URLError, HTTPError

AFFECTED_MAX = "wu#2016.437.295#0#20260327_105545"
VERSION_RE = re.compile(r"wu#\d+(?:\.\d+)*#\d+#\d{8}_\d{6}", re.IGNORECASE)


def parse_version(v):
    """Convert version string like wu#2016.437.295#0#20260327_105545 to a sortable tuple."""
    m = VERSION_RE.fullmatch(v.strip())
    if not m:
        return None
    try:
        body = v.strip()[3:]  # remove 'wu#'
        part1, part2, part3 = body.split('#')
        nums1 = tuple(int(x) for x in part1.split('.'))
        nums2 = (int(part2),)
        date_s, time_s = part3.split('_')
        nums3 = (int(date_s), int(time_s))
        return nums1 + nums2 + nums3
    except Exception:
        return None


def compare_versions(found, affected_max=AFFECTED_MAX):
    pf = parse_version(found)
    pa = parse_version(affected_max)
    if pf is None or pa is None:
        return None
    max_len = max(len(pf), len(pa))
    pf = pf + (0,) * (max_len - len(pf))
    pa = pa + (0,) * (max_len - len(pa))
    if pf <= pa:
        return "VULNERABLE"
    return "PATCHED"


def fetch_url(url):
    req = Request(url, headers={"User-Agent": "noisgate-verifier/1.0"})
    with urlopen(req, timeout=10) as resp:
        body = resp.read(1024 * 1024).decode("utf-8", errors="ignore")
        headers = "\n".join(f"{k}: {v}" for k, v in resp.getheaders())
    return headers + "\n" + body


def extract_version(text):
    m = VERSION_RE.search(text)
    return m.group(0) if m else None


def main():
    parser = argparse.ArgumentParser(description="Passive verifier for CVE-2026-34906")
    parser.add_argument("--url", help="Base URL of Wirtualna Uczelnia portal, e.g. https://portal.example.edu/")
    parser.add_argument("--version", help="Known installed version string, e.g. wu#2016.437.295#0#20260327_105545")
    args = parser.parse_args()

    if not args.url and not args.version:
        print("UNKNOWN - supply --url or --version")
        sys.exit(2)

    found_version = None

    if args.version:
        found_version = args.version.strip()
    elif args.url:
        candidates = [args.url.rstrip('/'), args.url.rstrip('/') + '/', args.url.rstrip('/') + '/login']
        last_err = None
        for u in candidates:
            try:
                text = fetch_url(u)
                found_version = extract_version(text)
                if found_version:
                    break
            except (HTTPError, URLError, TimeoutError, ValueError) as e:
                last_err = e
                continue
        if not found_version and last_err:
            print(f"UNKNOWN - could not extract version from URL ({last_err})")
            sys.exit(2)

    if not found_version:
        print("UNKNOWN - no version string found; verify locally with application inventory or vendor package metadata")
        sys.exit(2)

    result = compare_versions(found_version)
    if result is None:
        print(f"UNKNOWN - unparseable version string: {found_version}")
        sys.exit(2)

    print(f"{result} - detected version {found_version}; affected if <= {AFFECTED_MAX}")
    if result == "VULNERABLE":
        sys.exit(1)
    sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. CERT Polska advisory for CVE-2026-34906 / CVE-2026-34907
2. CISA Known Exploited Vulnerabilities Catalog
3. FIRST EPSS API endpoint
4. FIRST EPSS User Guide
5. CERT Polska prior Wirtualna Uczelnia RCE advisory (CVE-2025-12140)
6. Simple SA education platform page describing Wirtualna Uczelnia
7. CVE record landing page
8. OpenCVE product history for Simple SA Wirtualna Uczelnia