PT-2025-17382 · Unknown · Jinja2 Template Handler+1

Ybdesire · Published 2025-04-19 · Updated 2025-04-19 · CVE-2025-3805

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sarrionandia tournatrack up to 4c13a23f43da5317eea4614870a7a8510fc540ec

Description A critical vulnerability was found in the Jinja2 Template Handler component, specifically in the file check id.py. The manipulation of the ID argument leads to injection. This issue can be exploited on the local host. The exploit has been publicly disclosed and may be used.

Recommendations As a temporary workaround, consider restricting access to the check id.py file until a fix is available. Avoid using the ID argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Neutralization

Special Elements Injection

Weakness Enumeration

CWE-707

CWE-74

Related Identifiers

CVE-2025-3805

Affected Products

Jinja2 Template Handler

Sarrionandia Tournatrack

References · 10

• 🔥 https://github.com/sarrionandia/tournatrack/issues/86#issue-2982930491 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3805 · Security Note
• https://github.com/sarrionandia/tournatrack/issues/86 · Note
• https://t.me/cvedetector/23384 · Telegram Post
• https://vuldb.com/?submit.554781 · Note
• https://vuldb.com/?ctiid.305659 · Note
• https://t.me/cvetracker/21996 · Telegram Post
• https://vuldb.com/?id.305659 · Note
• https://t.me/cvenotify/119038 · Telegram Post
• https://twitter.com/CVEnew/status/1913675334391837045 · Twitter Post