What’s Vulnerable › Vulnerabilities

CVE-2021-41749

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 16.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-12 · updated 2026-06-17
• Weakness: CWE-94

Description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

Affected products

• Nystudio107 Seomatic: through 3.4.11

References

• https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
• https://github.com/nystudio107/craft-seomatic/commit/3fee7d50147cdf3f999cfc1e04cbc3fb3d9f2f7d
• https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
• https://github.com/nystudio107/craft-seomatic/commit/3fee7d50147cdf3f999cfc1e04cbc3fb3d9f2f7d

Get alerted when CVE-2021-41749 or the next vulnerability affects your stack