Graver

Graver Description Proof of Concept script to exploit the authenticated SSTI+RCE in Grav CMS CVE-2024-28116. It creates a malicious RCE page on the server running the vulnerable Grav CMS. References: https://nvd.nist.gov/vuln/detail/CVE-2024-28116 Notes Since it is an authenticated vulnerability ...

GenGravSSTIExploit

EN GenGravSSTIExploit is a PoC Python script that exploits an authenticated Server-Side Template Injection SSTI vulnerability in Grav CMS versions -p : Target URL in the format https://hostname. : Port number default is 80. Example: python GenGravSSTIExploit.py -t http://example.com -p 8080 4...

Grav CMS <1.3.0 - Cross-Site Scripting

Grav CMS before 1.3.0 is vulnerable to cross-site scripting via system/src/Grav/Common/Twig/Twig.php and allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin/tools. id: CVE-2018-5233 info: name: Grav CMS 1.3.0 - Cross-Site Scripting author: pikpikcu severity:...

Grav < 1.7 - Open Redirect

Grav before 1.7 has an open redirect vulnerability via common/Grav.php. This is partially fixed in 1.6.23 and still present in 1.6.x. id: CVE-2020-11529 info: name: Grav 1.7 - Open Redirect author: 0xAkoko severity: medium description: Grav before 1.7 has an open redirect vulnerability via...

CVE-2026-75827

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75827 CVE-2026-75827 Grav 2.0.13 - getgrav I am @abraxasnull. Loopback lab. The client is CVE-2026-75827-Abraxas-Labs.py. The denylist missed errorlog. Grav through 2.0.14 allowlists Class::method dynamic-dat...

CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - Authenticated RCE via Plugin Upload CVE-2025-50286 Grav CMS v1.7.48 with Admin Plugin v1.10.48 is vulnerable to Remote Code Execution RCE via the "Direct Install" plugin upload feature, allowing authenticated administrators to execute arbitrary PHP code ...

grav-cve-2024-28116

CVE-2024-28116 — Inyección de plantillas del lado del servidor SSTI con evasión del sandbox en Grav CMS Análisis y reproducción con Docker de CVE-2024-28116, una vulnerabilidad de inyección de plantillas del lado del servidor con evasión del sandbox de seguridad en Grav CMS hasta la versión 1.7.4...

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 Authenticated RCE Proof-of-concept for CVE-2026-65008 : authenticated remote code execution in Grav CMS via unrestricted calluserfuncarray in Blueprint::dynamicData. A user with admin.pages or api.pages.write can plant a malicious form frontmatter. The payload then...

CVE-2021-21425-RCE

this is my version i found a lot in internet but those are too bad USAGE python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 wait.. for 60sec you will get shell at your listener...

Grav-CMS-RCE-Authenticated

Grav CMS Remote Code Execution Authenticated - CVE-2024-28116 Info This code is an adaptation fromGraver Github repository with some improvements based on this video. Exploit against Grav CMS for versions below 1.7.45 based on SSTI + RCE vulnerabilities, labeled as CVE-2024-28116. This script...

CVE-2025-50286

Grav Admin Direct Install RCE CVE-2025-50286 Metasploit module and lab setup for authenticated Remote Code Execution in the Grav Admin Plugin Direct Install functionality. Overview CVE: CVE-2025-50286 Impact: Authenticated RCE Vector: Admin panel → Direct Install Result: Arbitrary command executi...

CVE-2021-29440

CVE-2021-29440 Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10 Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this...

CVE-2026-78851

Grav: Traversal de Ruta Autenticado / Divulgación Arbitraria de Directorios mediante Twig mediadirectory Reportero Nombre: CYBER-SEC Contacto: [email protected] Resumen La función Twig mediadirectory de Grav está expuesta dentro de la lista blanca del sandbox de Twig del contenido de páginas...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the getcookie function within the Twig sandbox. An attacker can obtain session identifiers belonging to privileged use...

Authorization Bypass Through User-Controlled Key

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the setNestedProperty process. An attacker can gain unauthorized administrative privilege...

Improper Handling of Case Sensitivity

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the web.config or lighttpd.conf configuration files due to case-sensitive access-control deny rules...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the array filter, which is registered without the necessary sandboxing guard. An attacker can access sensitive...

CVE-2026-100673

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists getcookie, which returns a...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...