Threat Intelligence Database

The Grav API plugin before version 1.0.0-rc.16 used a permissive CORS policy allowing all origins (Access-Control-Allow-Origin: *), including on authenticated endpoints. This configuration exposed the API to cross-origin requests from any website, enabling attackers who obtain valid access tokens to perform authenticated actions and access sensitive data. The issue was fixed in version 1.0.0-rc.16.

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.0-rc.16 accepts JWT access tokens via the URL query parameter ?token= on all API routes. This practice exposes tokens in web server logs, Referer headers, browser history, and proxy/CDN logs, risking token leakage. A leaked token allows unauthorized API access, including reading sensitive data, creating admin accounts, modifying settings, and deleting pages. The vulnerability has a high severity score of 8.2. No official patch or remediation guidance is currently provided.

Grav CMS versions prior to 2.0.4 contain a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function used within Twig content processing. This vulnerability can be triggered when Twig processing in page content is enabled, allowing an authenticated page editor to supply a crafted regular expression that causes excessive CPU usage and denial of service. The vulnerability arises from catastrophic backtracking in PHP's preg_replace() function. The default setting disables Twig processing, reducing exposure unless explicitly enabled.

A Cross-Site Request Forgery (CSRF) vulnerability exists in grav-plugin-login versions before 3.8.11. The vulnerability affects the login.regenerate2FASecret frontend task, allowing an attacker to force a logged-in user to regenerate their TOTP secret without proper CSRF protections. This causes the victim's two-factor authentication to become invalid, forcing re-enrollment. The issue does not affect sites configured with session.samesite set to Strict. The vulnerability has a low severity score.

Grav Flex-Objects versions before 1.4.3 have a broken access control vulnerability in the admin-next REST API. Authenticated users with only api.access permission can perform unauthorized create, read, update, delete, and export operations on directories that lack explicit permissions. This bypasses intended authorization controls, potentially exposing or modifying data in permission-less directories.

A Server-Side Request Forgery (SSRF) vulnerability exists in Grav before version 2.0.4. Authenticated users with api.webhooks.write permission can create webhooks using unsafe protocols such as file://, dict://, or gopher://. This allows triggering webhook events that may read local files, access process information, or interact with internal services. The vulnerability has a high severity score of 8.4.

A vulnerability in grav-plugin-api before version 1.0.6 allows non-super-admin users with api.users.write permissions to escalate their privileges to super-admin. This occurs because the plugin fails to properly validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints. Exploiting this flaw, attackers can create API keys tied to super-admin accounts or disable two-factor authentication for super-admin users, potentially leading to full instance takeover.

Grav versions prior to 2.0.4 have a critical vulnerability in the login plugin that allows bypassing two-factor authentication (2FA). The regenerate2FASecret task improperly checks only for user existence without verifying authorization during the pending TOTP challenge window. An attacker who knows a victim's password can exploit this to overwrite the victim's 2FA secret with a value of their choice, generate a valid TOTP code, and complete authentication, effectively reducing 2FA protection to password-only.

A vulnerability in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.6 allows an authorization bypass. API keys created with restricted scopes are not properly enforced, enabling these keys to perform any action the owning user can, including write, delete, or administrative operations. This issue is fixed in version 1.0.6.

Grav versions prior to 2.0.4 include a default .htaccess file with rules intended to block access to sensitive file types such as .yaml, .php, and .json. However, these rules lack the case-insensitive ([NC]) flag, causing extension matching to be case-sensitive. On case-insensitive filesystems like Windows NTFS, macOS HFS+, or Docker volume mounts, an unauthenticated attacker can bypass these restrictions by requesting files with uppercase or mixed-case extensions (e.g., .YAML, .PHP). This allows unauthorized reading of sensitive configuration files that may contain API keys and credentials.