CyberRota Analysis
AI-GeneratedGrav's file-based web platform prior to version 1.7.53 is vulnerable to a backup download flaw that allows authenticated administrators with backup permissions to access a ZIP archive containing sensitive files, including the administrator password hash and site configuration. This exposure could lead to unauthorized access and compromise of the web application. Organizations using affected versions should prioritize upgrading to 1.7.53 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.