CVE-2020-9757: SEOmatic for Craft CMS template injection leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, a public exploit reference, and very high EPSS make this an urgent pre-auth RCE risk.

What it is

The SEOmatic component for Craft CMS before 3.3.0 is vulnerable to server-side template injection through malformed data sent to the metacontainers controller. Because the injected template code is evaluated server-side, the flaw escalates to remote code execution, making it a serious risk for any site running an unpatched version.

Impact

An unauthenticated attacker can execute arbitrary code on the server, leading to full compromise of the Craft CMS host and any data it can reach.

Attack surface

Reached over the network via the metacontainers controller; the CVSS vector shows no privileges or user interaction required, so the endpoint is directly reachable by an unauthenticated attacker.

Exploitation

No CISA KEV listing and no ransomware association, but EPSS is very high (0.728, 99.4th percentile) and public exploit code is referenced, indicating active interest and likely weaponization.

What to do

• Upgrade SEOmatic to 3.3.0 or later immediately; the patch commits are public.
• If immediate upgrade is not possible, restrict or block access to the metacontainers controller endpoint.
• Apply a WAF rule to detect and block template-injection payloads targeting the controller.
• Audit Craft CMS and SEOmatic versions across all environments and confirm no older copies remain.
• Review server logs for prior exploitation attempts against the metacontainers endpoint.

Detection

• Search web logs for requests to the SEOmatic metacontainers controller with unusual or template-like parameters.
• Monitor for unexpected outbound connections or child processes spawned by the web server/PHP process.
• Alert on file writes or command execution originating from the Craft CMS application user.
• Check for unexpected changes to Craft CMS templates or configuration files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.