Server-side template injection (SSTI)
Server side template injection is a vulnerability in which user input is concatenated into a template that the server then renders, so the input is evaluated as template syntax rather than treated as data. Because template engines expose language objects, it usually escalates from expression evaluation to remote code execution.
The bug is in how the template is built, not in how the data is rendered. Passing a variable to a template is safe; building the template string from user input is not, and that is what happens when a developer wants dynamic wording in an email, an invoice or an error page.
Detection is a two step process. First establish that expressions are evaluated at all, by sending a probe containing the syntax of several engines at once and watching for an arithmetic result or a parse error. Then identify the engine from the shape of that error, because the escalation is engine specific: what you reach next is whatever object graph that language exposes, which in practice means walking from an ordinary object to a class loader, a runtime handle or a filter that runs a command.
The severity conversation is short. Unlike cross-site scripting, which executes in a visitor’s browser, this executes on the server, so it is written up as remote code execution and the evidence we hand over is a command output with the process identity, never a shell left behind. The fix is to stop building templates from input, and this is part of the web application testing where this turns up in custom rendering code.