Gemstone-Source

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig content.process enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg replace(), causing unbounded CPU consumption and denial of service to the web server process.

**Name of the Vulnerable Software and Affected Versions** grav-plugin-api versions prior to 1.0.4 **Description** An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the `sanitizeHttpUrl()` function fails to verify the host against the server's own origin, checking only that the URL scheme is http or https. The issue exists in the 'POST /api/v1/auth/forgot-password' endpoint via the `admin base url` field, and can also be influenced by the `Referer` or `Origin` headers. If a victim follows the malicious link, the valid reset token is disclosed to the attacker, allowing for full account takeover. **Recommendations** Update to version 1.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Grav version 2.0.0 **Description** An issue exists where the XSS blueprint validator `Security::detectXss()` processes raw page content before Twig processing occurs. If Twig content processing is enabled via `twig content.process enabled: true`, a user with page-write API permissions can bypass the validator using Twig's string concatenation operator (~) to dynamically create event handlers, dangerous tags, or protocols. Because the validator only sees the Twig expression and not the final rendered output, arbitrary JavaScript can be executed in the browsers of visitors when the content is rendered via `{{ page.content|raw }}`. **Recommendations** Update Grav to version 2.0.1. Disable the `twig content.process enabled` setting to prevent Twig content processing.