SSTI

What it is#

Server-side template injection (SSTI) happens when user input is compiled and rendered as a template itself, rather than passed as data into a fixed template, letting an attacker reach the template engine's own execution context.

How it works#

$greeting = $twig->createTemplate("Hello, " . $_GET['name'] . "!")->render();

Because $_GET['name'] becomes part of the template source rather than a variable substituted into it, template syntax inside it is compiled and run: {{ 7*7 }} renders 49, and an unsandboxed engine reachable this way can usually be walked to arbitrary code execution through its own object model.

Real-world impact#

Often direct remote code execution: SSTI is one of the few injection classes that routinely skips straight to RCE with no separate escalation step, because the "input" is itself executable code by design.

How to prevent it#

$twig->render('greeting.twig', ['name' => $_GET['name']]); // name is DATA

Never build a template string from user input. Pass user input as a variable into a template that is itself fixed application code, and if a "custom template" feature genuinely needs to compile user-supplied syntax, run it inside the engine's sandbox with a tight, tested allow-list, never an ordinary render.