{"id":"CVE-2018-14716","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-14716","generatedAt":"2026-10-29T01:50:01.583Z","title":"A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.","description":"A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.","published":"2018-08-06T20:29:01.000Z","lastModified":"2026-06-17T01:41:30.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-94"],"affected":["nystudio107/seomatic"],"epss":{"score":0.32673,"percentile":0.98334,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2018-07-31","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":45108,"kind":"exploit","title":"Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection","url":"https://www.exploit-db.com/exploits/45108","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/webapps/45108.txt","file":"exploits/linux/webapps/45108.txt","published":"2018-07-31","added":"2018-07-31","updated":"2018-08-09","author":"0xB455","type":"webapps","platform":"linux","port":null,"verified":false,"codes":["CVE-2018-14716"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 32.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f2749110508d1ce1","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/nystudio107/craft-seomatic/releases/tag/3.1.4","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://twitter.com/nystudio107/status/1021847835418009605","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://twitter.com/nystudio107/status/1021855169515057152","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/45108/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f2749110508d1ce1","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/nystudio107/craft-seomatic/releases/tag/3.1.4","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://twitter.com/nystudio107/status/1021847835418009605","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://twitter.com/nystudio107/status/1021855169515057152","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/45108/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-14716","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}