CVE-2021-41749 Code Injection in SEOmatic

What is CVE-2021-41749?

CVE-2021-41749 is a critical code injection vulnerability in n/a, published on 12 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

Weakness: CWE-94

Which versions are affected by CVE-2021-41749?

2 open source packages ship an affected version, including nystudio107/craft-seomatic. It affects 1 product.

Products include Nystudio107 Seomatic.

How do I fix CVE-2021-41749?

Upgrade nystudio107/craft-seomatic to 3.4.11 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-41749 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-41749 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2021-44618 Server-side Template Injection in nystudio107/craft-seomatic Critical 9.8
• CVE-2020-12790 SEOmatic for CraftCMS allows Server-Side Template Injection High 7.5
• CVE-2018-14716 SEOmatic plugin for Craft CMS SSTI Vulnerability High 7.5
• CVE-2021-41750 Cross-site Scripting in SEOmatic plugin Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g7xr-v82w-qggq.