24520597-blip/cve-2026-999999
A critical Server-Side Template Injection (SSTI) vulnerability exists in the X-Trading Portal v1.4.2 dashboard metadata rendering engine. The flaw is due to improper sanitization of user-controlled input in the username and widget_label fields before they are processed by the internal Smarty template parser.
This repository contains the core distribution and deployment configurations for the X-Trading Portal (XTP), a containerized solution designed for retail banking and stock trading services. This version (v1.4.2) includes the updated Dashboard UI and the new User Meta-Data Rendering Engine.
/login.php: Central authentication gateway./dashboard/: Primary user interface./dashboard/settings: User-customizable widget configurations (Handles widget_label and ).dashboard_theme/profile_view.php: Internal account metadata renderer using the Smarty engine./api/v1/trade/: REST API for transaction processing.The system utilizes server-side template rendering to allow institutional clients to inject custom CSS and MOTD (Message of the Day) banners directly into the portal dashboard. Ensure that the templates_c directory has appropriate write permissions for the PHP-FPM process.
Notice: This repository is part of the internal financial infrastructure. Unauthorized access is strictly prohibited under local cybersecurity regulations.