# Critical SSTI vulnerability in Wirtualna Uczelnia software allows unauthenticated remote…

Published: 2026-06-02 · Severity: critical · Sectors: education
Canonical: https://vorant.io/reports/652c9dbd-cca4-4361-8121-08e8d86b1068/critical-ssti-vulnerability-in-wirtualna-uczelnia-software-allows

> Critical SSTI vulnerability in Wirtualna Uczelnia software allows unauthenticated remote code execution; reflected XSS also present in locale parameter handling.

CERT Polska coordinated disclosure of two vulnerabilities affecting Wirtualna Uczelnia software. The primary issue, CVE-2026-34906, is a Server-Side Template Injection (SSTI) vulnerability that enables unauthenticated attackers to achieve Remote Code Execution. The flaw exists in the redirectToUrl endpoint's redirectUrlParameter, where inadequate input validation allows injection of arbitrary template expressions executed server-side. Exploitation permits attackers to execute remote commands and establish reverse shells without authentication.

A secondary vulnerability, CVE-2026-34907, involves Reflected Cross-Site Scripting (XSS) caused by insecure handling of the locale parameter across multiple endpoints. Attackers can weaponize this through crafted URLs containing JavaScript payloads that execute in victim browsers upon link activation.

Both vulnerabilities affect Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545. The issues were responsibly disclosed by Dawid Bakaj of VIPentest and coordinated through CERT Polska's vulnerability disclosure process.

## Mentioned in this report

- Vulnerabilities: CVE-2026-34906, CVE-2026-34907

## Detection guidance (public sample)

### Web Application Process Spawning Shell Interpreter (Linux)

ATT&CK: T1190

Detects a Java/Tomcat/httpd web server process spawning a shell interpreter, consistent with SSTI/RCE exploitation such as CVE-2026-34906 in Wirtualna Uczelnia. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Application Process Spawning Shell Interpreter (Linux)
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /java
    - /tomcat
    - /httpd
    - /apache2
    - /nginx
    - /catalina.sh
  shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /zsh
  filter:
    CommandLine|contains:
    - logrotate
    - healthcheck
    - startup.sh
    - shutdown.sh
  condition: selection and shell and not filter
falsepositives:
- Legitimate deployment or startup/shutdown scripts invoked by the application server
- Monitoring or health-check scripts spawned by the web server process
level: high
tags:
- attack.t1190
- attack.t1059
id: 2662ba4c-3886-5e76-be80-055916a7ed42
status: experimental
author: Vorant
```

### Web Server Process Spawning Command Interpreter (Windows)

ATT&CK: T1190

Detects java.exe, w3wp.exe, or tomcat service processes spawning cmd.exe or powershell.exe, indicative of RCE via SSTI exploitation against a web-facing Java application such as Wirtualna Uczelnia. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Interpreter (Windows)
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\java.exe
    - \\javaw.exe
    - \\w3wp.exe
    - \\tomcat9.exe
    - \\tomcat8.exe
    - \\httpd.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
  filter:
    CommandLine|contains:
    - C:\\Program Files\\Common Files
  condition: selection_parent and selection_child and not filter
falsepositives:
- Administrative scripts scheduled to run under the application pool identity
- Legitimate management tooling that shells out from the Java process for deployment
  tasks
level: high
tags:
- attack.t1190
- attack.t1059
id: 3829074e-3ad0-5fee-b9d8-9abe61d30096
status: experimental
author: Vorant
```

### Outbound Reverse Shell Connection From Web Application Process

ATT&CK: T1059

Detects a web server/Java process making an outbound network connection to a non-standard high port, consistent with reverse shell establishment following SSTI-based RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Reverse Shell Connection From Web Application Process
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \\java.exe
    - \\javaw.exe
    - \\w3wp.exe
    - \\tomcat9.exe
    - \\tomcat8.exe
    - \\httpd.exe
    - \\sh
    - \\bash
  filter_ports:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  condition: selection and not filter_ports
falsepositives:
- Application legitimately calling external APIs or update servers on non-standard
  ports
- Monitoring agents embedded in the application process communicating outbound
level: medium
tags:
- attack.t1059
- attack.t1185
- attack.t1190
id: 24fcf7e5-e64e-5504-b904-172da3e27603
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-34906

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/652c9dbd-cca4-4361-8121-08e8d86b1068/critical-ssti-vulnerability-in-wirtualna-uczelnia-software-allows.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup