Astroid Framework (astroid) 2.0.0 to 3.3.10 - Unauthenticated Arbitrary File Upload (RCE)
Astroid Framework by TemPlaza, versions 2.0.0 through 3.3.10, exposes an improperly secured file management feature on its AJAX endpoint. An unauthenticated attacker can upload dangerous file types, leading to remote code execution on the server. Astroid is a template framework, so the vulnerable code is present on every site whose template is built on it, regardless of which template is active. Fixed in 3.3.11, which the vendor released on 5 March 2026 with the note "Fixing security vulnerabilities at the AJAX endpoint". Update the Astroid Framework plugin to 3.3.11 or later (current release is 3.4.2). There is no configuration-level mitigation: the endpoint is reachable without a login.
Affected versions: ≥ 2.0.0 and ≤ 3.3.10
Full advisory: github.com
Astroid Framework (astroid) below 3.5.0 - Authenticated HTML Injection and Security-Attribute Override
Astroid Framework versions before 3.5.0 have two hardening issues fixed in the 3.5.0 release (28 Sep 2026), neither of which has been assigned a CVE by the vendor: (1) the Form Builder element output its configured submit-button text without escaping, allowing a user with backend access to the widget/page builder to inject arbitrary HTML into the rendered button; (2) the Button element's custom-attributes feature only blocked attribute names starting with "on" (blocking onclick etc.) but otherwise let any attribute through, so a backend widget-builder user could override the button's own href, id, class, target, rel or style attributes (e.g. redirecting the link or defeating rel=noopener on target=_blank links). Both require an already-authenticated backend user with access to edit the Astroid widget/page builder - not exploitable by anonymous or unauthenticated visitors - so severity is Low. Update to 3.5.0 or later.
Affected versions: < 3.5.0
Full advisory: github.com
