PT-2026-45723 · Unknown · Wirtualna Uczelnia

CVE-2026-34906 · Published 2026-06-02 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Wirtualna Uczelnia versions prior to wu#2016.437.295#0#20260327 105545

Description Server-Side Template Injection (SSTI) occurs when an unauthenticated attacker injects arbitrary template expressions into the server, which are then executed. This flaw exists in the 'redirectToUrl' endpoint via the redirectUrlParameter parameter due to insufficient input validation. Successful exploitation allows for Remote Code Execution (RCE), enabling the attacker to run remote commands and potentially establish a reverse shell.

Recommendations Update to a version newer than wu#2016.437.295#0#20260327 105545. As a temporary workaround, restrict access to the 'redirectToUrl' endpoint or avoid using the redirectUrlParameter parameter.

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-34906

Affected Products

Wirtualna Uczelnia

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34906 · Security Note
• https://cert.pl/posts/2026/06/CVE-2026-34906 · Note
• https://twitter.com/TuringCyberObs/status/2062121855301898377 · Twitter Post
• https://twitter.com/f1tym1/status/2061741995391963353 · Twitter Post
• https://simple.com.pl/branze/edukacyjna · Note
• https://t.me/CVEtracker/55589 · Telegram Post