CVE Catalog
CVE-2023-34251
CriticalCVSS 9.9Exploitation Probability (EPSS)
High risk2.34%
81th percentile - higher than 81% of all known CVEs
Summary
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection, allowing remote code execution by a user with page editing privileges.
Risk Assessment
The organization may be exposed to remote code execution, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to upgrade to version 1.7.42 or later to mitigate this vulnerability.
Original NVD description (English source)
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.