LaRecipe is vulnerable to Server-Side Template Injection attacks

LaRecipe versions before 2.8.1 allow attackers to inject malicious template code that gets executed on the server, potentially letting them run arbitrary commands and steal sensitive data. This is a critical flaw because it gives attackers near-complete control over the affected server.

Server-Side Template Injection (SSTI) in LaRecipe <2.8.1 permits unauthenticated or low-privilege attackers to inject malicious Blade/template syntax into user-controlled input fields, leading to arbitrary code execution on the server. The vulnerability stems from insufficient input sanitization before template rendering, allowing access to sensitive environment variables and system commands depending on server configuration and permissions.