EUVD-2026-58639
GHSA-rv98-5gw8-6hf9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required API key; S:C because allowlist write enables SSTI/RCE beyond the plugin's own trust boundary, elevating all three impact metrics to High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.
AnalysisAI
Scope-cap bypass in grav-plugin-api before 1.0.13 allows a holder of a least-privilege api.config.write API key issued on a super-admin account to append arbitrary tokens to Grav's Twig sandbox allowlist (persisted to user/config/security.yaml) via the POST /reports/twig-content/allowlist endpoint. Widening the allowlist eliminates the Twig sandbox boundary, converting any subsequent content render into a server-side template injection (SSTI) sink and ultimately enabling remote code execution on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid API key bearing api.config.write scope that was explicitly minted on a super-admin account - a key issued to a non-super account is insufficient because isSuperAdmin() will return false. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L) captures only the immediate allowlist-write impact and understates the realistic risk ceiling: successful allowlist widening converts all subsequent Twig renders on the instance into SSTI/RCE sinks, which should elevate confidentiality and availability impacts substantially. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who possesses or has socially engineered a least-privilege api.config.write API key issued on a super-admin Grav account sends a crafted POST /reports/twig-content/allowlist request, appending a permissive Twig tag (such as an unrestricted PHP filter) to the sandbox allowlist persisted in user/config/security.yaml. In a subsequent step - either by editing Grav content directly or by inducing a content editor to render attacker-influenced material - the attacker embeds a Twig SSTI payload exploiting the newly permitted tag, achieving arbitrary PHP execution on the server. … |
| Remediation | Upgrade grav-plugin-api to version 1.0.13 or later, which corrects the ReportsController to call requireSuper() in place of the bare isSuperAdmin(), ensuring API key scope restrictions are properly consulted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately audit all api.config.write API key issuance and revoke any permissions not directly required; examine user/config/security.yaml for unauthorized modifications and restore to baseline configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or e
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today