Wirtualna Uczelnia SSTI Flaw Enables Unauthenticated RCE
Unauthenticated attackers can achieve remote code execution via a server-side template injection flaw in Wirtualna Uczelnia's redirectToUrl endpoint.
CERT Polska coordinated disclosure of two vulnerabilities in Wirtualna Uczelnia, a university management software platform. The most severe, CVE-2026-34906, is a Server-Side Template Injection flaw in the redirectToUrl endpoint's redirectUrlParameter parameter. Insufficient input validation allows an unauthenticated attacker to inject arbitrary template expressions that execute on the server, potentially enabling remote command execution and reverse shell access.
A second, lower-severity issue, CVE-2026-34907, is a reflected Cross-Site Scripting vulnerability affecting the locale parameter across multiple endpoints. An attacker can craft a malicious URL embedding JavaScript in the locale parameter; when a victim opens the link, the script executes in their browser context. Both vulnerabilities affect Wirtualna Uczelnia versions up to build wu#2016.437.295#0#20260327_105545.
No evidence of active exploitation is noted in the advisory; this is a coordinated disclosure resulting from a report by an independent researcher. Organizations using Wirtualna Uczelnia, primarily educational institutions, should apply vendor patches once available and monitor for updates from CERT Polska.
Mentioned in this report
Detection guidance
SSTI Exploitation via Wirtualna Uczelnia redirectToUrl Parameter
HTTP request to Wirtualna Uczelnia redirectToUrl endpoint with template injection payloads in redirectUrlParameter - exploitation of CVE-2026-34906. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSTI Exploitation via Wirtualna Uczelnia redirectToUrl Parameter
description: Detects HTTP requests to Wirtualna Uczelnia redirectToUrl endpoint containing
template injection syntax in the redirectUrlParameter. Targets CVE-2026-34906 exploitation
attempts.
tags:
- attack.t1190
logsource:
category: proxy
product: any
detection:
selection_endpoint:
http_request_uri_path|contains: redirectToUrl
http_request_uri_query|contains: redirectUrlParameter
selection_injection:
http_request_uri_query|contains|all:
- redirectUrlParameter
- ${
filter_legitimate:
http_request_uri_query|contains: http
condition: selection_endpoint and selection_injection and not filter_legitimate
falsepositives:
- Legitimate URL parameter testing by developers or security scanners
level: high
id: 745f0d66-8953-5400-adb6-8b97b7076627
status: experimental
author: Vorant
Reverse Shell or Command Execution Following SSTI in Wirtualna Uczelnia
Process creation or network connection from Wirtualna Uczelnia application process (java.exe, tomcat) indicating command execution or reverse shell post-SSTI exploitation of CVE-2026-34906. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reverse Shell or Command Execution Following SSTI in Wirtualna Uczelnia
description: Detects suspicious child processes spawned by Wirtualna Uczelnia (Java/Tomcat
process) or outbound connections from the application process, indicating command
injection or reverse shell establishment following SSTI exploitation.
tags:
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \tomcat.exe
selection_child_suspicious:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \bash.exe
- \sh.exe
- \nc.exe
- \ncat.exe
filter_legitimate:
CommandLine|contains:
- -version
- -help
- catalina
condition: selection_parent and selection_child_suspicious and not filter_legitimate
falsepositives:
- Administrative scripts or deployment automation spawning shell processes from Java
application containers
- Monitoring or logging agents bundled with Wirtualna Uczelnia
level: high
id: c16cc942-2de6-5f5e-ad95-fcd89b0efc0b
status: experimental
author: Vorant
Reflected XSS Exploitation via Wirtualna Uczelnia Locale Parameter
HTTP request to Wirtualna Uczelnia endpoints with JavaScript payload in the locale parameter - exploitation of CVE-2026-34907 reflected XSS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Exploitation via Wirtualna Uczelnia Locale Parameter
description: Detects HTTP requests to Wirtualna Uczelnia endpoints containing JavaScript
code in the locale parameter. Targets CVE-2026-34907 reflected XSS exploitation
attempts, typically used in phishing or watering-hole attacks.
tags:
- attack.t1189
logsource:
category: proxy
product: any
detection:
selection_endpoint:
http_request_uri_query|contains: locale
http_request_host|endswith: wirtualna.uczelnia
selection_payload:
http_request_uri_query|contains|all:
- locale
- script
selection_javascript:
http_request_uri_query|re: locale=.*?(javascript:|onerror=|onload=|<script>)
filter_legitimate:
http_request_uri_query|contains:
- locale=en
- locale=pl
- locale=de
condition: (selection_endpoint and selection_payload) or (selection_endpoint and
selection_javascript) and not filter_legitimate
falsepositives:
- Security scanning tools testing XSS vectors
- Legitimate internationalization parameter variations with non-standard locale strings
level: medium
id: 892e2ab9-fdc6-524d-9727-84371982e2b0
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-34906
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free