CVE-2024-28118

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages ca...

CVE-2024-28118

Grav (open-source flat-file CMS) -- Affects versions prior to 1.7.45. Unrestricted access to the Twig extension class from the Grav context allows an attacker to redefine configuration variables, bypass a prior SSTI mitigation, and enable Twig processing of static pages by an admin. Since the Twi...