Description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav | < 1.8.0-beta.27 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | getgrav/grav | < 1.8.0-beta.27 | 1.8.0-beta.27 | GHSA-8535-hvm8-2hmv |