Easy
SSTI
NoteForge greeting template RCE
A sticky-note app. A custom greeting is compiled directly as an unsandboxed Twig template.
PentestingHere Academy
Official Academy lab
- Attempts
- 1
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
NoteForge lets you set a custom greeting shown on your dashboard. It's compiled as a Twig template on every page load, with no sandbox.
Goal
Achieve remote code execution through the custom greeting field and read the flag from /flag.txt (also available as the FLAG environment variable).