CVE-2024-22533

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Feb 2, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-22545.4The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgeCVE-2024-225436.1An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET reCVE-2024-225448.0An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the sCVE-2024-225457.8An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntCVE-2024-225466.4TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the do_setNTP function. An authenticated attacker with administrator privCVE-2024-225474.7WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).CVE-2024-225485.4FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section.CVE-2024-225495.4FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.CVE-2024-22555.4The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site ScriptingCVE-2024-225506.1An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code CVE-2024-225516.1WhatACart v2.0.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /site/default/search.CVE-2024-225595.4LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.