Grav File Upload Path Traversal Vulnerability: Severe Risks Ahead

CVE-2024-27921

What is CVE-2024-27921?

Grav, a widely used open-source flat-file content management system, has been found vulnerable to a file upload path traversal issue affecting versions prior to 1.7.45. This vulnerability allows attackers to upload or overwrite files with various extensions, including .json, .zip, .css, and .gif. The exploitation of this flaw can lead to serious consequences, such as the execution of arbitrary code on the affected server and potential manipulation of backup files. Moreover, attackers could leverage CSS exfiltration techniques to extract sensitive information from the system. To ensure the security of applications utilizing Grav, it is paramount to upgrade to the patched version 1.7.45 or higher.

References