CVE-2025-60355
Published: 28 October 2025
Summary
CVE-2025-60355 is a critical-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Zhyd Oneblog. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely patching or remediation of the specific SSTI flaw in OneBlog FreeMarker templates, eliminating the vulnerability.
SI-10 enforces validation and sanitization of user inputs to FreeMarker templates, directly blocking malicious SSTI payloads.
CM-6 establishes secure configuration baselines for OneBlog and FreeMarker to restrict unsafe template features exploitable in SSTI.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes unauthenticated remote exploitation of a public-facing web application via Server-Side Template Injection (SSTI) in FreeMarker templates, enabling arbitrary code execution, directly mapping to T1190 (Exploit Public-Facing Application) and T1221 (Template Injection).
NVD Description
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
Deeper analysisAI
CVE-2025-60355 is a Server-Side Template Injection (SSTI) vulnerability in zhangyd-c OneBlog versions 2.3.9 and prior, exploitable through FreeMarker templates. Mapped to CWE-1336, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its potential for complete system compromise.
Unauthenticated attackers with network access can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation enables high-impact disruption to confidentiality, integrity, and availability, allowing attackers to inject malicious templates that may lead to arbitrary code execution on the affected server.
Mitigation details are available in the referenced advisory at https://github.com/line2222/vuln/issues/4.
Details
- CWE(s)