CVE-2018-14716 in the critical feed json
SEOmatic plugin for Craft CMS SSTI Vulnerability
published 2018-08-06 8 y ago modified 2026-06-17 4 mo ago also GHSA-6j9m-rp7m-3gfg , EUVD-2022-2812
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 32.7%
- EPSS 32.7% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
Patch / fix
- packagist nystudio107/craft-seomatic 3.1.4
- nystudio107 seomatic 3.1.4
Timeline
- First public exploit (EDB-45108)
- Published
Exploit prediction
32.67% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-45108 Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection webapps, 2018-07-31
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | nystudio107/craft-seomatic | <3.1.4 |
3.1.4 |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f2749110508d1ce1
web, vendor-advisory
-
github.com
/nystudio107/craft-seomatic/releases/tag/3.1.4
web, patch, vendor-advisory
-
exploit-db.com
/exploits/45108/
exploit, third-party-advisory, vdb-entry
-
twitter.com
/nystudio107/status/1021855169515057152
web, vendor-advisory
-
twitter.com
/nystudio107/status/1021847835418009605
web, vendor-advisory
-
ha.cker.info
/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-14716
advisory
-
github.com
/nystudio107/craft-seomatic
package
-
exploit-db.com
/exploits/45108
web
-
ha.cker.info
/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic
web
Sources
- CVE List CVE-2018-14716
- GitHub Advisory GHSA-6j9m-rp7m-3gfg
- NVD CVE-2018-14716
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.