Design/Logic Flaw

2023-06-1422:15:00

PRIOn knowledge base

www.prio-n.com

grav

content management system

server side template injection

remote code execution

php code

administrator screen

page editing privileges

version 1.7.42 fix

7.4 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.5%

JSON

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.