-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allows arbitrary file reads through a path traversal weakness in the readFileFunc method within the Grav\Common\Twig\Extension\GravExtension class. This function is exposed to the Twig templating engine as the read_file function. The vulnerability description and Proof of Concept (PoC) show that an attacker with privileges to edit a page can create a form with a display field. The content of this field can be set to execute the read_file function with a path to a sensitive file on the server (e.g., /etc/passwd).
The provided commit ed640a13143c4177af013cf001969ed2c5e197ee directly patches the readFileFunc function. The original implementation simply checked if the file existed and then read it. The patch adds multiple security controls:
realpath() to prevent traversal sequences like ../.GRAV_ROOT directory, restricting file access to the application's intended scope.*.yaml), configuration files, and system directories.Therefore, the readFileFunc is the exact location of the vulnerability, as it's the function that processes the malicious input (the file path) and performs the insecure file operation.
Grav\Common\Twig\Extension\GravExtension::readFileFuncsystem/src/Grav/Common/Twig/Extension/GravExtension.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |
PHPPHPOngoing coverage of React2Shell