-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Template Injection (SSTI) in Grav's form processing, identified as GHSA-8535-hvm8-2hmv. The root cause is the insufficient sanitization of user-provided data that is subsequently rendered by the Twig templating engine. The proof-of-concept demonstrates that by injecting a malicious Twig expression into the __unique_form_id__ form parameter, an attacker can access and dump the _context variable, which contains sensitive application data.
The provided patch directly addresses this issue by hardening the Grav\Common\Security::cleanDangerousTwig function. Analysis of the commit e37259527d9c1deb6200f8967197a9fa587c6458 reveals that the original implementation of this function used a very limited and inadequate blocklist. The patch replaces this with a comprehensive and centralized approach using regular expressions to block a wide range of dangerous functions, properties, and patterns, including the _context variable that was exploited.
Therefore, the function Grav\Common\Security::cleanDangerousTwig is identified as the vulnerable function. It is the component that directly fails to neutralize the malicious input, thus creating the SSTI vulnerability. During exploitation, a stack trace would likely show this function being called as part of the form processing workflow before the template is rendered.
Grav\Common\Security::cleanDangerousTwigsystem/src/Grav/Common/Security.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |
Ongoing coverage of React2Shell