HackTheBox Writeups

45 writeups 22× Easy 15× Medium 5× Hard 3× Insane

Join CTF Team

Difficulty

Tag

Access

Sort

Showing 1–1 of 1

Medium Linux Locked

SSTI via resume upload, exploiting a Flask/Jinja2 template injection in a smart hiring app to achieve RCE and capture the flag.

ssti jinja2 flask rce +2

Benslates • May 16, 2026 • 1 min read

Other platforms

Proving Grounds 16 TryHackMe 2 All writeups