Medium
SSTI
ReportCraft footer sandbox escape
A PDF report generator. The custom footer template runs inside Twig's sandbox, and one allow-listed method escapes it.
PentestingHere Academy
Official Academy lab
- Attempts
- 0
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
ReportCraft generates PDF reports with a user-set custom footer, compiled as a Twig template inside Twig's SandboxExtension with an allow-list of tags, filters and methods.
Goal
Working only with what the sandbox's allow-list permits, read the internal flag value the app merges into the template context but never meant to expose.