CVE-2023-29689: PyroCMS 3.9 server-side template injection leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and public exploit references make this a critical risk for exposed PyroCMS 3.9 instances.

What it is

PyroCMS 3.9 contains a server-side template injection (SSTI) flaw that allows an attacker to inject and execute arbitrary commands on the server. The vulnerability is remotely reachable without authentication or user interaction, making it a critical remote code execution issue for exposed installations.

Impact

An attacker can execute arbitrary code on the affected system, leading to full server compromise, data theft, or further lateral movement. The CVSS vector indicates high confidentiality, integrity, and availability impact.

Attack surface

The flaw is reachable over the network via crafted template input, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Public exploit references exist (packetstormsecurity and a third-party advisory tagged Exploit), and EPSS indicates a high probability of exploitation (0.53463, 98.9th percentile). The CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch or upgrade PyroCMS beyond 3.9 if an official fix is available.
• If patching is not immediately possible, restrict network access to the PyroCMS administrative and template-handling interfaces.
• Disable or sandbox template rendering features that accept untrusted input until a fix is deployed.
• Monitor for and block SSTI payload patterns in web requests targeting template parameters.
• Review server logs for unexpected command execution or outbound connections from the PyroCMS host.

Detection

• Inspect web server and application logs for template syntax or command injection patterns in request parameters.
• Monitor for unexpected child processes spawned by the web server or application runtime.
• Alert on outbound network connections from the PyroCMS host to unusual destinations.
• Use file integrity monitoring to detect new or modified files in web-accessible directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.