CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.15 are vulnerable to an arbitrary file write issue due to insufficient validation in the Blueprint dynamic-data bare-function, allowing attackers with page-edit or blueprint-config access to exploit this flaw. This can lead to remote code execution by appending malicious PHP payloads to web-accessible files. Organizations using Grav should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.