THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-wf6j-gr27-g7ch (high) — GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

[GHSA] GHSA-wf6j-gr27-g7ch (high) — GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

medgithub_advisoriesPublished 2026-08-19

GHSA-wf6j-gr27-g7ch Severity: high CVE: CVE-2024-45747

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

### Summary A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary

MITRE ATT&CK techniques

Template InjectionT1221

Indicators of compromise

CVE-2024-45747cve

Original source: https://github.com/advisories/GHSA-wf6j-gr27-g7ch