Wirtualna Uczelnia SSTI Flaw Enables Unauthenticated RCE
Unauthenticated attackers can achieve remote code execution via a server-side template injection flaw in Wirtualna Uczelnia's redirectToUrl endpoint.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities in Wirtualna Uczelnia, a university management software platform. The most severe, CVE-2026-34906, is a Server-Side Template Injection flaw in the redirectToUrl endpoint's redirectUrlParameter parameter. Insufficient input validation allows an unauthenticated attacker to inject arbitrary template expressions that execute on the server, potentially enabling remote command execution and reverse shell access.
A second, lower-severity issue, CVE-2026-34907, is a reflected Cross-Site Scripting vulnerability affecting the locale parameter across multiple endpoints. An attacker can craft a malicious URL embedding JavaScript in the locale parameter; when a victim opens the link, the script executes in their browser context. Both vulnerabilities affect Wirtualna Uczelnia versions up to build wu#2016.437.295#0#20260327_105545.
No evidence of active exploitation is noted in the advisory; this is a coordinated disclosure resulting from a report by an independent researcher. Organizations using Wirtualna Uczelnia, primarily educational institutions, should apply vendor patches once available and monitor for updates from CERT Polska.
Mentioned in this report
Detection guidance
Reverse Shell or Command Execution Following SSTI in Wirtualna Uczelnia
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Process creation or network connection from Wirtualna Uczelnia application process (java.exe, tomcat) indicating command execution or reverse shell post-SSTI exploitation of CVE-2026-34906. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reverse Shell or Command Execution Following SSTI in Wirtualna Uczelnia
description: Detects suspicious child processes spawned by Wirtualna Uczelnia (Java/Tomcat
process) or outbound connections from the application process, indicating command
injection or reverse shell establishment following SSTI exploitation.
tags:
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \tomcat.exe
selection_child_suspicious:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \bash.exe
- \sh.exe
- \nc.exe
- \ncat.exe
filter_legitimate:
CommandLine|contains:
- -version
- -help
- catalina
condition: selection_parent and selection_child_suspicious and not filter_legitimate
falsepositives:
- Administrative scripts or deployment automation spawning shell processes from Java
application containers
- Monitoring or logging agents bundled with Wirtualna Uczelnia
level: high
id: c16cc942-2de6-5f5e-ad95-fcd89b0efc0b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-34906
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs