CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.19 are vulnerable to a remote code execution flaw due to improper handling of the Twig sort filter, allowing authenticated users with page-write permissions to execute arbitrary PHP code. This vulnerability arises from a misconfiguration in the sortFunc wrapper, which fails to properly sandbox function calls, enabling attackers to leverage crafted payloads. Organizations using affected versions of Grav, particularly those with user-generated content or forms, should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes spl_autoload through the sort filter, resulting in arbitrary PHP execution as the web server user.