CVE-2024-28116 — Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenti…
Published: 2024-03-21 · CVSS: 8.8 · CVSS 3.1
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7