Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getgrav | grav | before 1.7.42 | 1.7.42 | Patch available | CNA |
| — | getgrav/grav (Packagist) | before 1.7.42 | 1.7.42 | Patch available | GHSA-j3v8-v77f-fvgm |
- grav Vendorgetgrav Affected before 1.7.42 Fixed in 1.7.42 Patch available CNA
- getgrav/grav (Packagist) Vendor— Affected before 1.7.42 Fixed in 1.7.42 Patch available GHSA-j3v8-v77f-fvgm
Remediation
- Fix · CNA grav (getgrav) Fixed in 1.7.42
- Fix · GHSA-j3v8-v77f-fvgm getgrav/grav (Packagist) Fixed in 1.7.42 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34253
- 2026-10-03 Alias added: GHSA-j3v8-v77f-fvgm
References
Exploit 2
Patch 2
Other 6
- https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190
- https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec
- https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8
- https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5
- https://github.com/getgrav/grav
- https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66
More getgrav Grav vulnerabilities
- TI-2025-28971 Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
- TI-2021-22428 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) CVSS 4.0CRITICAL 9.3
- TI-2025-41064 In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig… CVSS 3.1CRITICAL 9.1
- TI-2026-30888 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. CVSS 4.0HIGH 8.8
- TI-2025-40773 Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS CVSS 3.1HIGH 8.8
- TI-2025-40768 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass CVSS 4.0HIGH 8.7
Sources
- CVE-2023-34253 · CVE Program
- CVE-2023-34253 · NVD
- FIRST EPSS
- GHSA-j3v8-v77f-fvgm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences