Grav CMS Access Control and Traversal Flaws

Origin validation bypass in Grav CMS before 2.0.16 lets remote attackers defeat the Referer-based same-origin check used by the Uri::referrer() and Pages::referrerRoute() methods. Because the check uses an unanchored str_starts_with() prefix match without a trailing delimiter, a request bearing a Referer from an attacker-controlled look-alike domain (e.g. https://example.com.attacker.tld) is accepted as same-origin, undermining CSRF/origin protections on protected routes. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Credential extraction in Grav CMS before 2.0.16 allows authenticated users with page-edit permissions to read hashed passwords and two-factor authentication secrets from User objects via insufficiently filtered Twig template sandbox methods. The allow-listed offsetGet() and offsetExists() methods on User objects expose sensitive fields that should be restricted within the sandboxed template context, enabling offline password cracking and subsequent authentication bypass. No public exploit has been identified at time of analysis, but the exploit technique is straightforward for any attacker holding page-edit rights.

Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.

Host header injection in Grav CMS before 3.9.2 allows attackers to poison outgoing invitation emails, replacing the legitimate site URL with an attacker-controlled domain in token-bearing links sent via the sendInvitationEmail() function. The vulnerability exploits a gap in Grav's existing Host header defenses: the require_trusted_host protection was applied only to password reset flows, leaving invitation emails without equivalent validation. When a poisoned invitation email is delivered and the recipient clicks the link, the one-time invitation token is transmitted to the attacker's server rather than the legitimate site. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the reported CVSS 4.0 score of 8.7 reflects high confidentiality risk from token capture.

Symlink following in Grav CMS Scheduler's Job::createLockFile() enables local attackers to overwrite arbitrary files writable by the web server process, affecting all versions prior to 2.0.16. The flaw arises because lock files are written to predictable paths inside a world-writable temp directory with no verification that the target path is not an attacker-controlled symlink; the next scheduled job execution blindly writes the job ID string to whatever the symlink points at. No public exploit has been identified at time of analysis, but the predictable path and world-writable directory make the conditions straightforward to stage on shared-hosting or multi-tenant systems.

Arbitrary file deletion in Grav CMS before 2.0.16 allows authenticated users holding media management permissions to delete files anywhere on the server filesystem via path traversal sequences in filenames passed to MediaUploadTrait::deleteFile(). The root cause is that deleteFile() validates only the basename of a supplied filename while passing the full, unvalidated path - including ../ sequences - directly to PHP's unlink(). No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity makes this straightforward to weaponize for any user who holds media upload/delete rights.

Configuration secret disclosure in Grav CMS before 2.0.16 allows authenticated content editors to extract sensitive values - including cache credentials - from system, site, and theme configuration arrays via the Twig templating engine. The sandboxed Twig render context fails to filter these configuration objects, permitting attackers to bypass the intended config_denied_paths restrictions using standard dot-notation syntax. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.1 reflects a high confidentiality impact for installations where editor access is not fully trusted.

Path traversal in Grav CMS before 2.0.16 exposes arbitrary server-side files to authenticated page authors through the `media_directory()` Twig function, which fails to validate attacker-supplied filesystem paths. Users holding page authoring privileges can supply arbitrary paths to `media_directory()` and then invoke the allow-listed filepath accessor on the resulting Medium object to read the contents of any file accessible to the web server process whose extension matches the CMS media allow-list. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low privilege requirement and high confidentiality impact make this a meaningful risk in any multi-author or externally-accessible Grav deployment.

Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.