External risk intelligence

OneBlog SSTI Vulnerability in FreeMarker Templates

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60355

OneBlog is a content management system (CMS) or blog platform, which is typically deployed as a public-facing web application. Since the vulnerability involves Server-Side Template Injection (SSTI) in the application's template processing, the web interface is directly reachable and exposed to internet users in standard deployment configurations.

Zhyd Oneblog

before 2.3.9

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical security flaw in OneBlog, a content management system. The vulnerability allows unauthorized attackers to inject malicious code through its template system, potentially leading to unauthorized access and control over the affected systems. The main concern is confirming relevance and exposure.

Code injection flaw in OneBlog's templates.
Critical flaw could allow unauthorized control.
Confirm relevance and exposure for OneBlog systems.

Attack Path

How an attacker could exploit the issue

An attacker could reach the OneBlog application over the network without needing any special access or user interaction. By submitting specially crafted input that is processed by the FreeMarker templating engine, an attacker could trigger a server-side template injection vulnerability. This could potentially allow the attacker to execute arbitrary code or commands on the server.

No authentication or user interaction needed.
FreeMarker template processing is the trigger.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity and confidentiality of data processed by OneBlog. When specific user-supplied input is processed through FreeMarker templates, an attacker could potentially inject malicious template code. This could lead to the execution of arbitrary commands on the server, allowing unauthorized access to sensitive information or manipulation of the application's behavior.

System and user data integrity.
Malicious template code injection.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Responsible teams include application owners, infrastructure, and potentially vendor management if OneBlog is a third-party solution. The immediate first step is to identify all instances of OneBlog, determine their reachability and business criticality, and pinpoint the accountable owner for each. Remediation planning should then proceed based on this risk assessment, prioritizing the most exposed and critical deployments.

Application owners should lead remediation efforts.
Verify OneBlog deployment reachability and criticality.
Plan phased remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OneBlog?

OneBlog is a content management system (CMS) or blogging platform designed to help users publish and manage web content. It functions as the underlying engine for a website, handling everything from user interface rendering to data management. Because it is designed to be accessible to visitors, it is typically hosted as a web application.

What does SSTI mean for CVE-2025-60355?

SSTI stands for Server-Side Template Injection, categorized as CWE-1336. In this CVE, the vulnerability exists because the software improperly handles user input within FreeMarker templates. Instead of treating input as simple text, the server inadvertently executes it as code, which can grant an attacker unauthorized control over the application's underlying server.

How is the FreeMarker vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted input to the OneBlog application over the network. The vulnerability occurs when this malicious input reaches the FreeMarker templating engine for processing. It is important to note that actions performed outside of the application's template processing logic do not trigger this specific issue.

Is my OneBlog instance at risk?

According to Halo Surface Signal, OneBlog is generally deployed as a public-facing web application. Since the vulnerability allows for remote interaction without authentication, any instance reachable over the internet is likely exposed. You should prioritize assessing any systems that are accessible to external users.

What should I do if I run OneBlog?

Begin by creating an inventory of all OneBlog instances within your environment to identify which systems are active. Confirm the version you are currently running and determine the business criticality of each instance. Once you have identified the owners, coordinate with them to prioritize and plan for necessary updates or mitigation steps.

References

github.com/line2222/vuln/issues/4

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.