Grav vulnerability allows arbitrary code execution and elevated privileges

CVE-2024-28119

What is CVE-2024-28119?

Grav, an open-source flat-file content management system, is subject to a vulnerability that allows an attacker to exploit unrestricted access to the Twig extension class within the Grav context. Prior to the release of version 1.7.45, any administrative user with the permission to create or edit pages could enable Twig processing of static pages in the front matter. This unsandboxed behavior permits the redefinition of the escape function, potentially leading to arbitrary code execution and privilege escalation within the Grav instance. Version 1.7.45 has implemented a patch to mitigate this security issue.

References