LaRecipe < 2.8.1 - Server-Side Template Injection
Title source: llmExploitation Summary
CVE-2025-53833 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including exploitintel, iQingshan. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2025-10622, demonstrating OS command injection in Foreman via the `ct_location` and `fcct_location` settings. The PoC scripts exploit the lack of server-side validation to execute arbitrary commands as the Foreman process user.
Description
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
Exploits (2)
The repository contains functional exploit code for CVE-2025-10622, demonstrating OS command injection in Foreman via the `ct_location` and `fcct_location` settings. The PoC scripts exploit the lack of server-side validation to execute arbitrary commands as the Foreman process user.
This repository provides a detailed technical analysis of CVE-2025-53833, a critical SSTI vulnerability in LaRecipe versions prior to 2.8.1, leading to unauthenticated RCE. It includes root cause analysis, impact assessment, and mitigation steps.
Nuclei Templates (1)
body="/binarytorch/larecipe/"
References (3)
Related Analysis
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
