Executive brief
Grav is an open-source flat-file content management system used to build and manage websites. A logged-in user can exploit a flaw in Grav's security validation to upload and execute arbitrary PHP code on the server, fully compromising the website and gaining the ability to run any command with the web server's privileges.
Technical details
The vulnerability exists in Grav's routine validation logic, which fails to properly sanitize routine names when expressed as component-function pairs. A safety check intended to block dangerous built-in routines only inspects routine names provided as single strings, and ignores the same routines when named as pairs (e.g., ["Class", "method"]). An authenticated attacker can leverage this bypass to call the internal unZip routine with an attacker-controlled archive and destination folder. By uploading a ZIP file containing PHP code to the predictable media folder and then directing the unZip routine to extract it into the web root, the attacker can write arbitrary PHP files that the server will execute. This requires a valid login session but no additional privileges, and the attack is entirely web-based.
Affected products
- Grav Grav CMS
Timeline
- 2026-09-17: disclosed