What Is SSTI? How to Find Server-Side Template Injection
SSTI means Server-Side Template Injection.
If user input is embedded into a server template and evaluated, attackers may break out of the template sandbox — sometimes all the way to remote code execution, depending on the engine.
Quick takeaway: Look for user input reflected through templates → detect evaluation with math payloads → identify the engine → escalate only in labs or clearly allowed tests.
Plain-language picture
Templates merge data into HTML email, PDFs, or pages.
Developers sometimes concatenate untrusted strings into the template source itself. That is the mistake.
Where hunters notice it
- Error pages that echo input oddly
- Email subject/body personalization
- PDF invoice generators
- “Preview template” admin tools
- CMS themes and notification builders
Detection without chaos
In labs, classic probes look like simple arithmetic inside template syntax variants ({{7*7}}, ${7*7}, etc.).
On live targets:
- Confirm reflection first
- Try the smallest detection that proves evaluation
- Stop and identify impact path before deep gadget hunting
If 49 appears where 7*7 went in, you likely have evaluation — not just HTML encoding.
Impact framing
Not every SSTI is instant RCE. Say what you proved:
- Template expression execution
- Possible sandbox escape (if demonstrated safely)
- Data leak from template context objects
Fixes
- Never concatenate untrusted input into template source
- Pass user data as template parameters only
- Keep engines patched and sandboxed
- Restrict who can edit templates
Original Bugflare article. Learning path aligned with PortSwigger SSTI academy content.