# Wirtualna Uczelnia RCE via SSTI flaw

Published: 2026-06-02 · Severity: high · Sectors: education
Canonical: https://vorant.io/reports/5c08ee9f-fbca-52a6-a960-78b5f55b680b/wirtualna-uczelnia-rce-via-ssti-flaw

> An unauthenticated SSTI vulnerability in Wirtualna Uczelnia software enables remote code execution, while a separate XSS flaw affects multiple endpoints via locale parameter.

CERT Polska coordinated disclosure of two vulnerabilities in Wirtualna Uczelnia, an academic management software platform. CVE-2026-34906 is a Server-Side Template Injection (SSTI) vulnerability in the redirectToUrl endpoint that allows unauthenticated attackers to achieve remote code execution. Insufficient input validation of the redirectUrlParameter permits injection of arbitrary template expressions executed server-side, enabling attackers to run commands and establish reverse shells.

A secondary vulnerability, CVE-2026-34907, is a Reflected Cross-Site Scripting (XSS) issue stemming from insecure handling of the locale parameter across multiple endpoints. Attackers can embed JavaScript in crafted URLs that execute in victims' browsers when clicked. Both vulnerabilities affect Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545. The issues were responsibly reported by Dawid Bakaj of VIPentest.

## Mentioned in this report

- Vulnerabilities: CVE-2026-34906, CVE-2026-34907

## Detection guidance (public sample)

### Web Application Server Spawning Command Shell (Possible SSTI RCE)

ATT&CK: T1059

Detects a Java/web application server process spawning a command interpreter or shell, consistent with post-exploitation of an SSTI vulnerability such as CVE-2026-34906. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Application Server Spawning Command Shell (Possible SSTI RCE)
id: 4aa961ee-f02d-5f2a-a977-bfa2fcb62586
status: experimental
description: Detects a Java/Tomcat/web application server process spawning a command
  shell or scripting interpreter, which is consistent with exploitation of a server-side
  template injection (SSTI) vulnerability leading to remote code execution, as seen
  in CVE-2026-34906 against Wirtualna Uczelnia.
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \catalina.sh
    - \tomcat.exe
    - \httpd.exe
    - \w3wp.exe
    - \nginx.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \sh.exe
    - \wscript.exe
    - \cscript.exe
  filter_deploy:
    CommandLine|contains:
    - deployment
    - healthcheck
  condition: selection_parent and selection_child and not filter_deploy
falsepositives:
- Legitimate application server administration scripts that intentionally shell out
  for maintenance tasks
- Java-based monitoring or deployment agents that invoke shell commands during startup
level: high
```

### Server-Side Template Injection Payload in Redirect URL Parameter

ATT&CK: T1190

Detects HTTP requests containing template expression syntax in redirect-related URL parameters, indicative of SSTI exploitation attempts such as CVE-2026-34906 against the Wirtualna Uczelnia redirectToUrl endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Server-Side Template Injection Payload in Redirect URL Parameter
id: b82d869e-3da8-5765-9ca3-770ac965dfe4
status: experimental
description: Detects web server access log entries where a redirect-related URL parameter
  (e.g. redirectToUrl, redirectUrlParameter) contains template expression syntax commonly
  used to perform server-side template injection (SSTI), as exploited in CVE-2026-34906.
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
    - redirectToUrl
    - redirectUrlParameter
  selection_payload:
    cs-uri-query|contains:
    - ${
    - '#{'
    - '{{'
    - <%
    - Runtime.getRuntime
    - ProcessBuilder
  condition: selection_param and selection_payload
falsepositives:
- Automated vulnerability scanners actively probing the application with SSTI payloads
  (expected during authorized testing)
- Legitimate URLs that coincidentally include template-like characters in encoded
  redirect values
level: high
```

### Outbound Reverse Shell Connection from Web Application Process

ATT&CK: T1059

Detects a Java or web server process making an outbound network connection shortly after spawning, consistent with a reverse shell established via SSTI-to-RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Reverse Shell Connection from Web Application Process
id: 94b224a6-8fd8-579a-8c0b-f0977148232f
status: experimental
description: Detects a Java-based web application server process initiating an outbound
  network connection to a non-standard high port, which can indicate a reverse shell
  established after exploitation of a server-side template injection vulnerability
  like CVE-2026-34906.
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
    - \httpd.exe
    - \w3wp.exe
  selection_conn:
    Initiated: true
    DestinationPort:
    - 4444
    - 1337
    - 8081
    - 9001
    - 31337
  filter_internal:
    DestinationIp|startswith:
    - '10.'
    - 172.16.
    - 192.168.
  condition: selection_image and selection_conn and not filter_internal
falsepositives:
- Legitimate application traffic to internal monitoring or clustering ports that overlap
  with commonly used reverse shell ports
- Development or QA environments where developers intentionally connect to debug listeners
  on similar ports
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-34906

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5c08ee9f-fbca-52a6-a960-78b5f55b680b/wirtualna-uczelnia-rce-via-ssti-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup