Wirtualna Uczelnia RCE via SSTI flaw
An unauthenticated SSTI vulnerability in Wirtualna Uczelnia software enables remote code execution, while a separate XSS flaw affects multiple endpoints via locale parameter.
CERT Polska coordinated disclosure of two vulnerabilities in Wirtualna Uczelnia, an academic management software platform. CVE-2026-34906 is a Server-Side Template Injection (SSTI) vulnerability in the redirectToUrl endpoint that allows unauthenticated attackers to achieve remote code execution. Insufficient input validation of the redirectUrlParameter permits injection of arbitrary template expressions executed server-side, enabling attackers to run commands and establish reverse shells.
A secondary vulnerability, CVE-2026-34907, is a Reflected Cross-Site Scripting (XSS) issue stemming from insecure handling of the locale parameter across multiple endpoints. Attackers can embed JavaScript in crafted URLs that execute in victims' browsers when clicked. Both vulnerabilities affect Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545. The issues were responsibly reported by Dawid Bakaj of VIPentest.
Mentioned in this report
Detection guidance
Web Application Server Spawning Command Shell (Possible SSTI RCE)
Detects a Java/web application server process spawning a command interpreter or shell, consistent with post-exploitation of an SSTI vulnerability such as CVE-2026-34906. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Application Server Spawning Command Shell (Possible SSTI RCE)
id: 4aa961ee-f02d-5f2a-a977-bfa2fcb62586
status: experimental
description: Detects a Java/Tomcat/web application server process spawning a command
shell or scripting interpreter, which is consistent with exploitation of a server-side
template injection (SSTI) vulnerability leading to remote code execution, as seen
in CVE-2026-34906 against Wirtualna Uczelnia.
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \catalina.sh
- \tomcat.exe
- \httpd.exe
- \w3wp.exe
- \nginx.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \bash.exe
- \sh.exe
- \wscript.exe
- \cscript.exe
filter_deploy:
CommandLine|contains:
- deployment
- healthcheck
condition: selection_parent and selection_child and not filter_deploy
falsepositives:
- Legitimate application server administration scripts that intentionally shell out
for maintenance tasks
- Java-based monitoring or deployment agents that invoke shell commands during startup
level: high
Server-Side Template Injection Payload in Redirect URL Parameter
Detects HTTP requests containing template expression syntax in redirect-related URL parameters, indicative of SSTI exploitation attempts such as CVE-2026-34906 against the Wirtualna Uczelnia redirectToUrl endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Server-Side Template Injection Payload in Redirect URL Parameter
id: b82d869e-3da8-5765-9ca3-770ac965dfe4
status: experimental
description: Detects web server access log entries where a redirect-related URL parameter
(e.g. redirectToUrl, redirectUrlParameter) contains template expression syntax commonly
used to perform server-side template injection (SSTI), as exploited in CVE-2026-34906.
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains:
- redirectToUrl
- redirectUrlParameter
selection_payload:
cs-uri-query|contains:
- ${
- '#{'
- '{{'
- <%
- Runtime.getRuntime
- ProcessBuilder
condition: selection_param and selection_payload
falsepositives:
- Automated vulnerability scanners actively probing the application with SSTI payloads
(expected during authorized testing)
- Legitimate URLs that coincidentally include template-like characters in encoded
redirect values
level: high
Outbound Reverse Shell Connection from Web Application Process
Detects a Java or web server process making an outbound network connection shortly after spawning, consistent with a reverse shell established via SSTI-to-RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Reverse Shell Connection from Web Application Process
id: 94b224a6-8fd8-579a-8c0b-f0977148232f
status: experimental
description: Detects a Java-based web application server process initiating an outbound
network connection to a non-standard high port, which can indicate a reverse shell
established after exploitation of a server-side template injection vulnerability
like CVE-2026-34906.
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection_image:
Image|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \httpd.exe
- \w3wp.exe
selection_conn:
Initiated: true
DestinationPort:
- 4444
- 1337
- 8081
- 9001
- 31337
filter_internal:
DestinationIp|startswith:
- '10.'
- 172.16.
- 192.168.
condition: selection_image and selection_conn and not filter_internal
falsepositives:
- Legitimate application traffic to internal monitoring or clustering ports that overlap
with commonly used reverse shell ports
- Development or QA environments where developers intentionally connect to debug listeners
on similar ports
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-34906
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free