Grav CMS vulnerabilities

Grav CMS before version 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session deserialize untrusted data without class restrictions, enabling PHP object injection and, via a gadget chain, arbitrary code execution. Additionally, InstallCommand's git clone operation does not escape branch, url, and path parameters, allowing OS command injection during plugin/theme installation (requires admin access). A Twig security blocklist bypass (server-side template injection) is also present.

Grav is a flat-file content management system. In versions prior to 1.7.42, there was a server-side template injection vulnerability that allowed remote code execution by not blocking certain built-in functions exposed by Twig.

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection, allowing remote code execution by a user with page editing privileges.

Grav CMS 2.0.14 through 2.0.24 has a privilege escalation vulnerability in group and account blueprints. Dot-notation keys like `access.admin.super` bypass guards and let an operator with admin.users grant themselves full super-admin.

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with) with no trailing delimiter. An attacker controlling a domain that begins with the victim site's origin (e.g., https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.

Grav CMS before version 2.0.16 has a timing vulnerability in Utils::verifyNonce() that uses non-constant-time comparison (===) instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonces byte-by-byte.

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process can write to, and the next scheduled job run will follow the symlink and overwrite the target file's content with the job ID string.

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation. An authenticated user can upload a ZIP file containing PHP code, bypass name validation using array notation, and write PHP files to the web root for execution.

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(). The function passes its unsanitized $image argument to UniformResourceLocator::findResource(), which only lexically collapses '..' segments without a realpath check. An editor with page-editing rights can use Markdown image syntax with traversal sequences to composite arbitrary image files outside the media sandbox into a carrier image, which is then served publicly.

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives. Blueprint::isSafeDynamicCall() only applies its denylist to strings without '::'. An account with page-editing rights (admin.pages) can plant a directive that invokes an arbitrary public static PHP method with attacker-controlled arguments. This allows reading any server-readable file and arbitrary creation/copying of files and directories.

The scheduler-webhook plugin in Grav CMS contains an authentication bypass vulnerability. An unauthenticated attacker can remotely trigger configured scheduled jobs by sending a single POST request to the webhook endpoint.

A vulnerability was found in Grav CMS up to version 1.7.49.5/2.0.0-beta.1 in the FileCache::doGet function of the Cache Value Handler component, leading to deserialization. The attack can be launched remotely but requires high complexity and is difficult to exploit. The exploit has been made public. Upgrading to version 2.0.0-beta.2 addresses the issue.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling access to files outside the intended webroot directory.

Grav CMS prior to 1.8.0-beta.27 is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.

Grav is a flat-file content management system. In versions prior to 1.7.42, the denylist was insufficient, allowing low privileged attackers to inject malicious templates and achieve remote code execution.