CVE-2026-34906: Wirtualna Uczelnia RCE Vulnerability

CVE-2026-34906 Overview

CVE-2026-34906 is a Server-Side Template Injection (SSTI) vulnerability in Wirtualna Uczelnia, a Polish academic management platform used by higher education institutions. The flaw exists in the redirectToUrl endpoint, where the redirectUrlParameter parameter accepts user input without proper sanitization. Unauthenticated attackers can inject arbitrary template expressions that the server evaluates during rendering. Successful exploitation enables Remote Code Execution (RCE), including the ability to spawn a reverse shell on the host. The vulnerability affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545 and is tracked under CWE-1336.

Critical Impact
An unauthenticated remote attacker can achieve full Remote Code Execution on the application server through a single HTTP request to the vulnerable endpoint.

Affected Products

Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545
Deployments exposing the redirectToUrl endpoint to untrusted networks
Academic environments integrating Wirtualna Uczelnia with single sign-on portals

Discovery Timeline

2026-06-02 - CVE-2026-34906 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-34906

Vulnerability Analysis

The vulnerability is a Server-Side Template Injection flaw classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The application passes user-controlled input from the redirectUrlParameter value directly into a template rendering context. When the template engine evaluates the resulting string, attacker-supplied expressions execute within the server process. Because the endpoint requires no authentication, the attack surface includes any network-reachable instance.

Root Cause

The redirectToUrl endpoint fails to validate or escape input before passing it to the template engine. Template engines designed to render trusted layouts treat the input as code, exposing built-in objects and reflection primitives. Attackers chain these primitives to reach runtime classes capable of invoking operating system commands. See the CERT Polska advisory for additional context.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An adversary submits an HTTP request to the redirectToUrl endpoint with a crafted redirectUrlParameter value containing template syntax. The template engine evaluates the expression on the server, allowing the attacker to read sensitive data, write to disk, or establish an interactive reverse shell. Lateral movement into adjacent academic systems and credential stores follows from the initial code execution. Technical details are described in the CERT Polska post on CVE-2026-34906.

Detection Methods for CVE-2026-34906

Indicators of Compromise

HTTP requests to the redirectToUrl endpoint containing template delimiter sequences such as ${, {{, <%, or #{ inside redirectUrlParameter
Unexpected child processes spawned by the Wirtualna Uczelnia application service, particularly shells, curl, wget, or powershell
Outbound network connections from the application host to unfamiliar IP addresses on common reverse-shell ports
Web access logs showing unauthenticated requests with URL-encoded payloads targeting the redirect parameter

Detection Strategies

Inspect web server and reverse proxy logs for template metacharacters in query string and POST body parameters
Correlate requests to redirectToUrl with process creation events on the application server
Apply behavioral analytics to flag the Wirtualna Uczelnia process spawning interpreters or networking utilities
Deploy web application firewall rules that match common SSTI payloads referenced in public exploitation research

Monitoring Recommendations

Forward web server, application, and host telemetry into a centralized analytics platform for correlation
Alert on first-time parent-child process relationships involving the Wirtualna Uczelnia service account
Monitor egress traffic from application servers and baseline expected destinations
Review authentication logs on adjacent systems for follow-on credential abuse after suspected exploitation

How to Mitigate CVE-2026-34906

Immediate Actions Required

Restrict network access to the redirectToUrl endpoint to trusted networks until a fixed build is deployed
Contact the Wirtualna Uczelnia vendor for a patched release that supersedes wu#2016.437.295#0#20260327_105545
Audit web access logs for prior exploitation attempts containing template syntax in redirectUrlParameter
Rotate credentials, API tokens, and session secrets stored on or accessible from the application server

Patch Information

The CERT Polska advisory for CVE-2026-34906 is the authoritative source for fixed version information. Administrators should track vendor communications through the Simple education sector page and apply updates as soon as they are released. Until a patch is available, treat all deployments as exploitable.

Workarounds

Deploy a web application firewall rule blocking requests where redirectUrlParameter contains {{, ${, <%, #{, or URL-encoded equivalents
Place the application behind an authenticating reverse proxy to remove unauthenticated exposure of the vulnerable endpoint
Run the Wirtualna Uczelnia service as a least-privileged account with restricted egress firewall rules
Disable or remove the redirectToUrl functionality if it is not required for operational workflows

bash

# Example WAF rule (ModSecurity) blocking SSTI payloads on the vulnerable parameter
SecRule ARGS:redirectUrlParameter "@rx (\{\{|\$\{|<%|#\{|%7B%7B|%24%7B)" \
    "id:1026349060,phase:2,deny,status:403,log,\
    msg:'CVE-2026-34906 SSTI payload blocked in redirectUrlParameter'"