Critical · 9.8 CVE-2021-31635 EUVD-2023-1774GHSA-cgmm-c2m9-ff7r

jFinal Server-Side Template Injection vulnerability

Published Jun 26, 2023 · Updated Dec 5, 2024 · Assigned by mitre

Description

Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.

Ecosystem	Package	Affected	Fixed	Record
Maven	com.jfinal:jfinal	<= 4.9.08	—	GHSA-cgmm-c2m9-ff7r