CyberRota Analysis
AI-GeneratedGrav versions prior to 3.9.2 are vulnerable due to inadequate validation of untrusted Host headers in the sendInvitationEmail() function, allowing attackers to craft malicious invitation links. This flaw enables redirection of users to attacker-controlled domains, circumventing existing protections meant for password reset flows. Organizations using Grav should prioritize patching this vulnerability to mitigate the risk of phishing attacks and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.