Server-side Template Injection (SSTI) in grav

CVE-2023-37897

What is CVE-2023-37897?

Grav, a file-based web platform built in PHP, is susceptible to a server side template injection vulnerability due to improper validation in its template processing functionality. The flaw exists because a previous fix incorrectly allows certain functions to bypass the denylist, enabling an attacker to execute malicious payloads. This exploitation requires either an administrator account or a non-administrator account with specific permissions within the admin panel. Users are strongly encouraged to update to version 1.7.42.2, where this issue has been resolved, as there are currently no known workarounds.

References