Executive brief
Grav, a popular open-source content management system, is vulnerable to a security flaw in its plugin installation tool. An attacker with administrative access can upload a malicious ZIP file that, when processed by the system, allows them to execute arbitrary commands on the server. This could lead to a complete takeover of the website, data theft, or a total service outage.
Technical details
A vulnerability in Grav's Admin plugin and Grav Package Manager (GPM) core allows for Remote Code Execution (RCE) and Path Traversal (Zip Slip). The 'directInstall' task fails to validate the contents of uploaded ZIP archives before extraction. An authenticated attacker with administrative privileges can upload a ZIP containing malicious PHP scripts or path traversal primitives (e.g., '../') to write files to arbitrary locations or execute code upon plugin initialization. The root cause is located in 'Installer::install()' and 'Gpm.php', where extraction occurs without extension or path validation. A partial fix in version 2.0.0-beta.2 introduces path validation to prevent Zip Slip, though administrators are still cautioned to only install plugins from trusted sources as the feature's intent is to execute PHP.
Affected products
- getgrav Grav < 2.0.0-beta.2
Timeline
- 2026-04-24: patched: Partial fix applied in Grav core 2.0 branch
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: other: NVD published