The vulnerability in Grav CMS prior to version 2.0.16 involves improper origin validation in the Uri::referrer() and Pages::referrerRoute() methods. These methods use an unanchored string prefix match (str_starts_with) to validate the Referer header, which does not require a trailing delimiter. Consequently, an attacker who controls a domain beginning with the victim site's origin (e.g., https://example.com.attacker.tld) can craft a Referer header that is incorrectly treated as same-origin, bypassing the intended origin check.

This vulnerability allows an attacker to bypass the Referer-based origin validation, potentially enabling unauthorized actions that rely on origin checks. The CVSS score of 5.4 indicates a medium severity impact with low confidentiality and integrity impact and no availability impact. There is no evidence of known exploits in the wild.

A fix is available in Grav CMS version 2.0.16. Users should upgrade to version 2.0.16 or later to remediate this vulnerability. No additional mitigation steps are indicated.