Vendor
Grav CMS Twig Sandbox Vulnerability Allows Plugin Secret Exfiltration
2 rulesA vulnerability in the Grav CMS Twig sandbox allow-list allows any user with the `admin.pages` role to call `config.toArray()` from within a page body, dumping the entire merged site configuration, including all plugin secrets, into the rendered HTML.
Grav CMS Stored XSS Vulnerability Leading to Potential RCE
2 rules 2 TTPsA stored XSS vulnerability exists in Grav Core + Admin Plugin versions before 2.0.0-beta.2, where a low-privileged user can inject malicious code via a crafted tag, potentially leading to the exfiltration of admin session context, bypassing CSRF protections, and escalating to remote code execution (RCE).
Grav CMS Privilege De-escalation via User Overwrite
2 rules 2 TTPs 1 IOCA low-privileged user with user creation permissions in Grav CMS can overwrite existing accounts, including the primary administrator, leading to a Denial of Service (DoS) and privilege de-escalation by exploiting a business logic vulnerability in versions prior to 2.0.0-beta.2.
Grav CMS FormFlash Unauthenticated Path Traversal and Arbitrary File Write
2 rules 2 TTPsGrav CMS is vulnerable to an unauthenticated path traversal vulnerability within the FormFlash component, allowing attackers to create arbitrary directories and write files, leading to configuration injection and potential denial of service; fixed in version 2.0.0-beta.2.
Grav CMS Multiple RCE Vulnerabilities
3 rules 2 TTPsMultiple critical and high severity remote code execution vulnerabilities exist in Grav CMS due to unsafe unserialize functions, command injection in git clone, and an SSTI blocklist bypass, impacting versions prior to 2.0.0-beta.2.
Grav Login Plugin Privilege Escalation Vulnerability
2 rules 1 TTP 1 IOCUnauthenticated users can escalate privileges to admin in Grav CMS by manipulating registration data due to missing server-side validation in the Login plugin.