Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2024-28116 EUVD-2024-0899GHSA-c9gp-64c4-2rrh

Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

Published Mar 21, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: getgrav Product: grav Package: getgrav/grav Ecosystem: Packagist

Description

Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.

Affected products

VendorProductAffectedFixed
getgrav grav < 1.7.45 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • akabe1/Graver ★ 8 · Mar 24, 2024

    Proof of Concept script to exploit the authenticated SSTI+RCE in Grav CMS (CVE-2024-28116)

  • geniuszly/GenGravSSTIExploit ★ 7 · Oct 5, 2024

    is a PoC Python script that exploits an authenticated Server-Side Template Injection (SSTI) vulnerability in Grav CMS versions <= 1.7.44 (CVE-2024-28116)

  • bebarossi/grav-cve-2024-28116 ★ 0 · Aug 19, 2026

    Analysis and Docker reproduction of CVE-2024-28116 - SSTI with sandbox bypass in Grav CMS

  • gunzf0x/Grav-CMS-RCE-Authenticated ★ 0 · Sep 7, 2024

    Exploit against Grav CMS (versions below 1.7.45) that allows Remote Code Execution for an authenticated user - CVE-2024-28116

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist getgrav/grav < 1.7.45 1.7.45 GHSA-c9gp-64c4-2rrh

References