Executive brief
Aetopia Digital Asset Management (DAM), a platform used by large organizations to store and share media files, contains a security vulnerability in its project management features. An authorized user can submit specially crafted text in the name or description fields to execute unauthorized commands on the server. This could allow an attacker to access sensitive internal data, modify system files, or disrupt the platform's operations.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in Aetopia Digital Asset Management (DAM) v1.0.0. The vulnerability is located in the '/c/project/[ID]/edit' endpoint, specifically within the 'name' and 'description' POST parameters. The application uses the Twig template engine and fails to properly sanitize user input before evaluation. An authenticated attacker can inject Twig expressions (e.g., {{7*7}}) to achieve remote code execution (RCE) or expose internal application data. The attack requires network access and valid user credentials to access the project editing functionality.
Affected products
- Aetopia Digital Asset Management (DAM) 1.0.0
Timeline
- 2026-07-14: advisory: CVE published by NVD/MITRE