Skip to content
Heist/ feed
Back to feed
High

Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

Type: advisorySources: OSV

Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-34253
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 04:01 UTC · Revision 1

Source evidence

Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

core-osv · Original source

Published 14 Jun 2023, 22:00 UTC

Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.

osv:CVE-2023-34253
Complete source record
{
  "id": "4491cb246dae9b41877f5d992b379734faa10ab213f2818b798f54b16e81db85",
  "url": "https://osv.dev/vulnerability/CVE-2023-34253",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass",
    "summary": "Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.",
    "evidence": "osv:CVE-2023-34253",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2023-34253",
      "aliases": [
        "CVE-2023-34253",
        "GHSA-j3v8-v77f-fvgm"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/getgrav/grav",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "dc209453d0817547db0d3a8b27110decb63f2b5d"
                },
                {
                  "fixed": "71bbed12f950de8335006d7f91112263d8504f1b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.7.42"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "71bbed12f950de8335006d7f91112263d8504f1b"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1.7.41.2",
            "1.7.41.1",
            "1.7.41",
            "1.7.40",
            "1.7.39.4",
            "1.7.39.3",
            "1.7.39.2",
            "1.7.39.1",
            "1.7.39",
            "1.7.38",
            "1.7.37.1",
            "1.7.37",
            "1.7.36",
            "1.7.35",
            "1.7.34",
            "1.7.33",
            "1.7.32",
            "1.7.31",
            "1.7.30",
            "1.7.29.1",
            "1.7.29",
            "1.7.28",
            "1.7.27.1",
            "1.7.27",
            "1.7.26.1",
            "1.7.26",
            "1.7.25",
            "1.7.24",
            "1.7.23",
            "1.7.22",
            "1.7.21",
            "1.7.20",
            "1.7.19",
            "1.7.18",
            "1.7.17",
            "1.7.16",
            "1.7.15",
            "1.7.14",
            "1.7.13",
            "1.7.12",
            "1.7.10",
            "1.7.9",
            "1.7.8",
            "1.7.7",
            "1.7.6",
            "1.7.5",
            "1.7.4",
            "1.7.3",
            "1.7.1",
            "1.7.0",
            "1.7.0-rc.20",
            "1.7.0-rc.19",
            "1.7.0-rc.18",
            "1.7.0-rc.17",
            "1.7.0-rc.15",
            "1.7.0-rc.14",
            "1.7.0-rc.13",
            "1.7.0-rc.12",
            "1.7.0-rc.10",
            "1.7.0-rc.9",
            "1.7.0-rc.8",
            "1.7.0-rc.7",
            "1.7.0-rc.6",
            "1.7.0-rc.5",
            "1.7.0-rc.4",
            "1.7.0-rc.3",
            "1.7.0-rc.2",
            "1.7.0-rc.1",
            "1.7.0-beta.10",
            "1.7.0-beta.9",
            "1.7.0-beta.8",
            "1.7.0-beta.7",
            "1.7.0-beta.6",
            "1.7.0-beta.5",
            "1.7.0-beta.4",
            "1.7.0-beta.3",
            "1.7.0-beta.2",
            "1.7.0-beta.1",
            "1.6.0-rc.4",
            "1.6.0-rc.3",
            "1.6.0-rc.2",
            "1.6.0-rc.1",
            "1.6.0-beta.8",
            "1.6.0-beta.7",
            "1.6.0-beta.6",
            "1.6.0-beta.5",
            "1.6.0-beta.2",
            "1.6.0-beta.1",
            "1.5.0-rc.1",
            "1.5.0-beta.2",
            "1.5.0-beta.1",
            "1.3.0-rc.5",
            "1.3.0-rc.4",
            "1.3.0-rc.3",
            "1.3.0-rc.1",
            "1.2.0-rc.3",
            "1.2.0-rc.2",
            "1.2.0-rc.1",
            "1.1.9-rc.3",
            "1.1.9-rc.2",
            "1.1.9-rc.1",
            "1.1.0-rc.3",
            "1.1.0-rc.2",
            "1.1.0-rc.1",
            "1.1.0-beta.5",
            "1.1.0-beta.4",
            "1.1.0-beta.3",
            "1.1.0-beta.2",
            "1.1.0-beta.1",
            "0.9.19",
            "0.9.18",
            "0.9.17",
            "0.9.16",
            "0.9.15",
            "0.9.14",
            "0.9.13",
            "0.9.12",
            "0.9.11",
            "0.9.10",
            "0.9.9",
            "0.9.8",
            "0.9.7",
            "0.9.6",
            "0.9.5",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.0",
            "0.8.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34253.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.774268718Z",
      "provider": "osv",
      "references": [
        "https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190",
        "https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/",
        "https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34253.json",
        "https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-34253",
        "https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-1336",
          "CWE-184"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34253.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-34253",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492351,
  "published_at": "2023-06-14T22:00:12.569+00:00"
}