Craft CMS versions prior to build 2791 suffer from a server-side template injection vulnerability.