CyberRota Analysis
AI-GeneratedGrav CMS versions prior to 2.0.13 are vulnerable due to a remote code execution flaw in the Flex Objects plugin, which allows authenticated users to upload ZIP files containing malicious PHP code. This vulnerability enables attackers to bypass name validation and execute arbitrary code on the server, potentially compromising the entire web application. Organizations using Grav CMS, especially those with user-upload functionalities, should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.