Executive brief
Grav CMS is a flat-file content management system. Before version 2.0.16, it incorrectly validates the HTTP Referer header when checking if a request originates from the same website, using a flawed string comparison that accepts any domain starting with the site's name. An attacker controlling a lookalike domain (e.g., example.com.attacker.tld if the target is example.com) can bypass security checks designed to prevent cross-site attacks, potentially leading to unauthorized actions being treated as trusted.
Technical details
The vulnerability is a string prefix matching error (CWE-346: Origin Validation Error) in the Uri::referrer() and Pages::referrerRoute() methods. Both methods use str_starts_with($referrer, $base) where $base is the site's root URL without a trailing slash (e.g., "https://example.com"). This unanchored comparison accepts any Referer header that begins with that string, including "https://example.com.attacker.tld", allowing an attacker controlling a domain with the victim site's name as a prefix to bypass origin validation. The attack requires user interaction (the victim must click a link or be redirected from the attacker's site). A patch is available in version 2.0.16, which adds proper boundary checking with a trailing slash delimiter.
Affected products
- Grav CMS < 2.0.16
Timeline
- 2026-08-25: disclosed
- 2026-08-10: patched: Patch released in version 2.0.16