User input embedded in server-side templates is evaluated as template code, enabling remote code execution, file read, and full server compromise through template engine features.
Immediate Response
1Disable template rendering for user-controlled input immediately.
2Isolate the affected service and review logs for evidence of exploitation.
3Rotate all credentials and secrets accessible from the compromised server.
4Assess lateral movement and check connected systems for compromise indicators.
