Threats Tagged 'ghsa-ggph-mfjj-69jr'

Grav versions before 2.0.18 contain a remote code execution vulnerability in the Twig sort filter. This flaw allows an authenticated user with page-write permissions to execute arbitrary PHP code via a crafted payload exploiting the sortFunc wrapper's improper sandboxing. The vulnerability arises because the isSandboxed argument is hardcoded to false, enabling the use of dangerous functions like spl_autoload within the sandbox.