CyberRota Analysis
AI-GeneratedGrav CMS versions prior to 2.0.13 are vulnerable to a server-side template injection flaw that enables low-privileged page editors to execute arbitrary operating system commands. This vulnerability allows attackers to inject malicious Twig payloads through unsanitized email fields, potentially leading to remote code execution upon form submission. Organizations using Grav CMS should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.