Khant-Nyar

Writeups

1 writeup

HackTheBox Medium Linux Locked

Flask web app vulnerable to SSTI via user-controlled templates. Exploit Jinja2 injection to achieve RCE, then escalate privileges on Linux for root.

flask ssti python linux +2

Jun 25, 2026 • 4 min read