PT-2024-2486 · Grav Cms · Grav Cms

Akabe1

·

Published

2024-03-21

·

Updated

2025-09-11

·

CVE-2024-28116

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 1.7.45
Description The issue is related to a Server-Side Template Injection (SSTI) in Grav CMS, which allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. The vulnerability is due to the incorrect management of code generation. An attacker could exploit this issue by injecting specially crafted Twig template directives into a web page, allowing them to execute arbitrary OS commands on the remote web server. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.
Technical details about exploitation include:
  • API Endpoints: None specified
  • Vulnerable Parameters or Variables: system.twig.safe functions and system.twig.safe filters
  • Function Names: registerUndefinedFunctionCallback() and registerUndefinedFilterCallback()
Recommendations For Grav CMS versions prior to 1.7.45, update to version 1.7.45 or later to resolve the issue. As a temporary workaround, consider restricting access to the Twig template directives to minimize the risk of exploitation. Avoid using the system.twig.safe functions and system.twig.safe filters variables in the affected API endpoints until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-1336CWE-94

Related Identifiers

BDU:2024-02464
CVE-2024-28116
GHSA-C9GP-64C4-2RRH

Affected Products

Grav Cms