Description
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection.

This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-11
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Code Injection via template engine
Action: Patch Update
AI Analysis

Impact

Improper neutralization of special elements used in the template engine enables an attacker to inject server‑side code that is executed when the template is rendered, potentially compromising confidentiality, integrity, and availability of the web application. This vulnerability is a classic case of server‑side template injection, classified as CWE‑1336.

Affected Systems

Arma Digital Media Inc. Website Template versions up to 11092026 are affected. No newer releases have been confirmed to contain a fix and the vendor has not responded to the disclosure.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. The EPSS score of < 1% suggests a very low likelihood of exploitation in practice, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request that includes malicious template syntax, which the engine interprets and executes.

Generated by OpenCVE AI on September 21, 2026 at 04:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an updated version of the Website Template beyond 11092026, if one becomes available from the vendor.
  • Sanitize all input that can be interpreted by the template engine or configure it to operate in a safe rendering mode that disallows arbitrary code execution.
  • Deploy a web application firewall or enforce content security policies to block unsafe template payloads and monitor logs for suspicious request patterns.

Generated by OpenCVE AI on September 21, 2026 at 04:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Arma Digital Media
Arma Digital Media website Template
Vendors & Products Arma Digital Media
Arma Digital Media website Template

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Title CSTI in Arma Digital's Website Template
Weaknesses CWE-1336
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Arma Digital Media Website Template
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-09-11T19:20:34.143Z

Reserved: 2026-05-21T08:15:18.924Z

Link: CVE-2026-9160

cve-icon Vulnrichment

Updated: 2026-09-11T19:20:28.655Z

cve-icon NVD

Status : Deferred

Published: 2026-09-11T18:17:00.497

Modified: 2026-09-11T20:20:08.930

Link: CVE-2026-9160

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T04:30:08Z

Weaknesses
  • CWE-1336

    Improper Neutralization of Special Elements Used in a Template Engine