Grav 安全漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav prior to version 1.7.45, which stems from a file upload and path traversal vulnerability in the application...

Grav 代码注入漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product displays. A security vulnerability exists in Grav prior to version 1.7.45, which stems from validating accessible functions via the Utils::isDangerousFunction function,...

PT-2024-22138

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.45 Description A file upload path traversal vulnerability has been identified in Grav, an open-source, flat-file content management system. This vulnerability enables attackers to replace or create files with...

PT-2024-2486

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 1.7.45 Description The issue is related to a Server-Side Template Injection SSTI in Grav CMS, which allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the...

CVE-2024-28117: Improper Control of Generation of Code

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute...

CVE-2024-28116: Improper Control of Generation of Code

Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection SSTI, which allows any authenticated user editor permissions are sufficient to execute arbitrary code on the remote server bypassing the existing securit...

PT-2024-22274 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.45 Description: The issue arises from unrestricted access to the twig extension class from the grav context, allowing an attacker to redefine the escape function and execute arbitrary commands. This can be achieved ...

PT-2024-22272 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.45 Description: Grav is an open-source, flat-file content management system. The issue arises because Grav validates accessible functions through the Utils::isDangerousFunction function but does not impose...

PT-2024-22273 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.45 Description: The issue arises due to unrestricted access to the twig extension class from the Grav context, allowing an attacker to redefine config variables and bypass previous SSTI mitigation. This can lead to...

CVE-2024-28118: Improper Control of Generation of Code

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages ca...

CVE-2024-27921: Improper Limitation of a Pathname to a Restricted Directory

Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw pose...

CVE-2024-28119: Improper Control of Generation of Code

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front...

Grav 安全漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav prior to version 1.7.45, which stems from unrestricted access to the twig extension class from the grav environment...

Input validation

Grav is a content management system CMS. Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue...

Insufficient Permission Validation

getgrav/grav is vulnerable to Insufficient Permission Validation. The vulnerability is due to enabling regular users with page creation privileges to access the Frontmatter feature when the datajsonheaderform parameter is included in the POST body while creating a page. The vulnerability is also...

CVE-2024-27923 Remote Code Execution by uploading a phar file using frontmatter

Grav is a content management system CMS. Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue...

CVE-2024-27923 Remote Code Execution by uploading a phar file using frontmatter

Grav is a content management system CMS. Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue...

CVE-2024-27923

Grav is a content management system CMS. Prior to version 1.7.43, users who may write a page may use the "frontmatter" feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue...

CVE-2024-27923

CVE-2024-27923 affects Grav CMS prior to 1.7.43. The issue arises from insufficient permission validation and inadequate filename validation in the Frontmatter feature, enabling a regular page writer to inject a malicious Frontmatter that can lead to Remote Code Execution (RCE). The vulnerability...

CVE-2024-27923 Remote Code Execution by uploading a phar file using frontmatter

Grav is a content management system CMS. Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue...