CVE-2025-60355

CRITICAL LAB

zhangyd-c OneBlog <2.3.9 - Server-Side Template Injection

Title source: llm

Description

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

Exploits (1)

github WORKING POC
by exploitintel · pythonpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2025-60355

References (1)

Scores

CVSS v3 9.8
EPSS 0.0009
EPSS Percentile 25.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Lab Environment

Lab screenshot
admin admin-patched builder builder-patched mysql web web-patched
docker pull ghcr.io/exploitintel/cve-2025-60355-admin:latest
All Labs GitHub

Classification

CWE
CWE-1336
Status published

Affected Products (1)

zhyd/oneblog < 2.3.9

Timeline

Published Oct 28, 2025
Tracked Since Feb 18, 2026