Grav vulnerabilities

Grav before version 2.0.1 contains a decompression bomb vulnerability in the ZipArchiver::extract() method, which lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

Grav before version 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method allowlist, the raw container remains accessible via the allow-listed grav.offsetGet('config'), which returns the real Config object. Allow-listed object-dumping filters (json_encode, print_r, yaml_encode) then serialize that object at the PHP level without invoking the sandbox method gate, exposing the full config tree including plugin secrets such as SMTP credentials, API keys, and plugin DB credentials.

Grav before version 2.0.0 (up to 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the resize() action in Excerpts::processMediaActions() writes caller-controlled values directly into the image's styleAttributes. A lower-privileged content editor who can edit page Markdown can store a crafted image URL with semicolon-delimited CSS declarations in the resize parameters, which are rendered into the final <img style=...> attribute when a higher-privileged reviewer/admin views the page or preview.

Grav before version 2.0.0-beta.2 contains an XML external entity injection (XXE) vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files.

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint. Attackers can inject malicious scripts into the data[readableName] parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed, posing a significant security risk. This vulnerability is fixed in 1.11.0-beta.1.

In Grav prior to 1.8.0-beta.27, users with read access to the user account management section of the admin panel can view password hashes of all users, including the admin. This exposure can potentially lead to privilege escalation if an attacker cracks these hashes.

In Grav prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability exists related to the handling of the scheduled_at parameter. The application fails to properly sanitize cron expressions, allowing an attacker to render the admin panel non-functional by manipulating the parameter, such as with a single quote.

In Grav prior to 1.8.0-beta.27, a low-privilege user with page editing privilege can read any server files using the "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user passwords, 2FA secrets, and password reset tokens.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav's Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator.

In Grav prior to 1.8.0-beta.27, a user with user creation privilege can create a new user with a username containing path traversal sequences (e.g., ..\Nijat or ../Nijat), causing the account YAML file to be written outside user/accounts/. The written YAML can contain account fields such as email, fullname, twofa_secret, and hashed_password.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This stems from weak regex validation in the cleanDangerousTwig method.

Grav, a file-based web platform built in PHP, is vulnerable to a server side template injection (SSTI) attack. Version 1.7.42 and later have a flaw in the `isDangerousFunction()` which allows the execution of malicious code by prepending a double backslash (`\`).