CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2025-10-28

Last modified

2026-10-27

Weaknesses

CWE-1336

Affected products

• Oneblog (Zhyd)

References

• https://github.com/line2222/vuln/issues/4