Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-79310

Quick assessment

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

webpy 框架的 web.py 0.76 版本存在服务端模板注入（SSTI）漏洞。模板引擎可能被诱导执行由攻击者控制的模板代码，而这类代码本应被内置的安全检查机制拒绝。当应用程序从攻击者拥有写权限的目录预编译模板，随后通过预编译模板加载器渲染这些模板时，沙箱机制会被绕过，导致攻击者的代码得以执行，最终造成任意 Python 代码执行以及服务器上的操作系统命令执行。

AI Predicted 9.8 Difficulty: Moderate EPSS 0.67% · P52 Updated Sep 24, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
n/a	n/a	`n/a`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to and later renders them through the precompiled template loader, the sandbox is bypassed and the attacker's code runs, resulting in arbitrary Python code execution and OS command execution on the server.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	n/a	n/a	-

II. Public POCs for CVE-2026-79310

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-79310

请登录查看更多情报信息。

Proof of Concept for CVE-2026-79310 (1)

🔗 TraceLoom/CVEs/CVE-2026-79310.md at main · lichoin/TraceLoom · GitHub Read full article

Other References for CVE-2026-79310 (1)

🔗 GitHub - webpy/webpy: web.py is a web framework for python that is as simple as it is powerful. · GitHub

https://www.cve.org/CVERecord?id=CVE-2026-79310

Same Patch Batch · n/a · 2026-09-23 · 9 CVEs total

CVE-2026-6668	7.5 HIGH	Integer overflow causes an infinite loop in packet buffer growth in PgBouncer
CVE-2026-19888	7.5 HIGH	NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
CVE-2026-79304	6.5 MEDIUM	CyberPanel 1.9.1 路径遍历漏洞
CVE-2026-79306	6.5 MEDIUM	CyberPanel v1.9.1 文件管理器路径遍历漏洞
CVE-2026-6669	5.9 MEDIUM	Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
CVE-2026-95897	5.5 MEDIUM	Dask Loader core.py from_npy_stack deserialization
CVE-2026-96739	4.3 MEDIUM	SEMCMS KindEditor Upload upload_json.php cross site scripting
CVE-2025-63564		Moodle Socialwall 3.0-3.3 SQL注入漏洞

IV. Related Vulnerabilities

Same product: n/a

Same vendor: n/a