Grav Server-side Template Injection via Insufficient Validation in filterFilter
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getgrav | grav | before 1.7.42 | 1.7.42 | Patch available | CNA |
| — | getgrav/grav (Packagist) | before 1.7.42 | 1.7.42 | Patch available | GHSA-96xv-rmwj-6p9w |
- grav Vendorgetgrav Affected before 1.7.42 Fixed in 1.7.42 Patch available CNA
- getgrav/grav (Packagist) Vendor— Affected before 1.7.42 Fixed in 1.7.42 Patch available GHSA-96xv-rmwj-6p9w
Remediation
- Fix · CNA grav (getgrav) Fixed in 1.7.42
- Fix · GHSA-96xv-rmwj-6p9w getgrav/grav (Packagist) Fixed in 1.7.42 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34252
- 2026-10-03 Alias added: GHSA-96xv-rmwj-6p9w
References
Other 6
- https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Twig/Extension/GravExtension.php#L1692-L1698
- https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1956-L2074
- https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b
- https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8
- https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5
- https://github.com/getgrav/grav
More getgrav Grav vulnerabilities
- TI-2025-28971 Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
- TI-2021-22428 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) CVSS 4.0CRITICAL 9.3
- TI-2025-41064 In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig… CVSS 3.1CRITICAL 9.1
- TI-2026-30888 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. CVSS 4.0HIGH 8.8
- TI-2025-40773 Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS CVSS 3.1HIGH 8.8
- TI-2025-40768 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass CVSS 4.0HIGH 8.7
Sources
- CVE-2023-34252 · CVE Program
- CVE-2023-34252 · NVD
- FIRST EPSS
- GHSA-96xv-rmwj-6p9w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences