Jacobsoo

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 1.7.42 **Description** Grav is a flat-file content management system with a logic flaw in the `GravExtension.filterFilter()` function. This flaw allows validation against a denylist of unsafe functions to be skipped when an array is passed as a callable argument, instead of a string. A low-privileged attacker with login access to the Grav Admin panel and page creation/update permissions can inject malicious templates to obtain remote code execution. The vulnerability is found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. **Recommendations** For versions prior to 1.7.42, update to version 1.7.42 to resolve the issue. Additionally, ensure that `twig.undefined functions` and `twig.undefined filters` properties in the `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 1.7.42 **Description** The issue concerns a flat-file content management system where the denylist, introduced to prevent the execution of dangerous functions via malicious template injection, was insufficient. This allowed a low-privileged attacker with login access to the Grav Admin panel and page creation/update permissions to inject malicious templates, potentially leading to remote code execution. The denylist could be subverted in multiple ways, including using unsafe functions not banned, using capitalized callable names, and using fully-qualified names for referencing callables. **Recommendations** For versions prior to 1.7.42, update to version 1.7.42 to improve the denylist and prevent the execution of dangerous functions via malicious template injection.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 1.7.42 **Description** The issue concerns a server-side template injection vulnerability leveraging the default `filter()` function. This allows for remote code execution by invoking arbitrary unsafe functions through other built-in functions exposed by Twig's Core Extension. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided. Technical details include the use of Twig's Core Extension and its built-in functions such as `map()` and `reduce()`. The `filter()` function and variables like `$arrow` are involved in the vulnerability. **Recommendations** For versions prior to 1.7.42, update to version 1.7.42 or later, which includes a patch that overrides the built-in Twig `map()` and `reduce()` filter functions to validate the argument passed to the filter in `$arrow`.