Description
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Grav CMS Admin Direct Install Authenticated Plugin Upload RCE
exploit/multi/http/grav_admin_direct_install_rce_cve_2025_50286
Exploit-DB 1
- Grav CMS 1.7.48 - Remote Code Execution (RCE) EDB-52402 · webapps · Aug 11, 2025
GitHub 2 repositories
-
binneko/CVE-2025-50286 ★ 2 · Aug 5, 2025
-
x1o3/CVE-2025-50286 ★ 0 · Feb 28, 2026
Metasploit exploit for the CVE-2025-50286.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.