CVE-2023-34448

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke...

CVE-2023-34448 Grav Server-side Template Injection (SSTI) via Twig Default Filters

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke...

CVE-2023-34448

CVE-2023-34448 (Grav CMS) is a follow-up to CVE-2022-2073. Grav before v1.7.42 allowed remote code execution via Twig default filters (map and reduce) through unsafe callable arguments, because Grav’s patch for filter() only blocked certain calls on string arrows. The public patch/update in Grav ...