CVE-2025-60355

CRITICAL LAB

zhangyd-c OneBlog <2.3.9 - Server-Side Template Injection

Title source: llm

Description

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

Exploits (1)

github WORKING POC
by exploitintel · pythonpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2025-60355

References (1)

Related Analysis

Scores

CVSS v3 9.8
EPSS 0.0004
EPSS Percentile 10.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull redis:7-alpine

Details

CWE
CWE-1336
Status published
Products (1)
zhyd/oneblog < 2.3.9
Published Oct 28, 2025
Tracked Since Feb 18, 2026