CVE-2024-27923

HIGH

Grav < 1.7.43 - Remote Code Execution via Frontmatter Feature

Title source: llm
STIX 2.1

Description

Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0136
EPSS Percentile 68.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-287 CWE-434
Status published
Products (2)
getgrav/grav < 1.7.43
getgrav/grav 0 - 1.7.43Packagist
Published Mar 21, 2024
Tracked Since Feb 18, 2026