PT-2026-20267 · Unknown+1 · Freemarker+1

CVE-2025-70830 · Publicado 2026-02-17 · Atualizado 2026-02-22

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Datart version 1.0.0-rc.3

Description A Server-Side Template Injection (SSTI) flaw exists in the Freemarker template engine of Datart. Authenticated attackers can execute arbitrary code by injecting crafted Freemarker template syntax into the SQL script field. The affected API endpoint is not specified. The vulnerable parameter is the SQL script field, using Freemarker template syntax. The vulnerable function is not specified.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user-supplied input to the SQL script field to prevent the injection of malicious Freemarker syntax.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-70830

Produtos afetados

Datart

Freemarker

Referências · 9

• 🔥 https://github.com/xiaoxiaoranxxx/CVE-2025-70830 · Exploit
• https://github.com/running-elephant/datart · Nota
• https://osv.dev/vulnerability/CVE-2025-70830 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2025526040958026174 · Publicação no Twitter
• https://t.me/CVEtracker/44868 · Publicação no Telegram
• https://portswigger.net/web-security/server-side-template-injection · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-70830 · Nota de Segurança
• https://twitter.com/CVEnew/status/2023791780118818938 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2023807507303395690 · Publicação no Twitter