High severityNVD Advisory· Published Mar 6, 2024· Updated Aug 2, 2024
Remote Code Execution by uploading a phar file using frontmatter
CVE-2024-27923
Description
Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
getgrav/gravPackagist | < 1.7.43 | 1.7.43 |
Affected products
1Patches
1e3b0aa0c502ainlcude phar in dangerous extensions
2 files changed · +7 −0
CHANGELOG.md+6 −0 modified@@ -1,3 +1,9 @@ +# v1.7.42.4 +## mm/dd/2023 + +2. [](#improved) + * Include `phar` in the list of `security.uploads_dangerous_extensions` + # v1.7.42.3 ## 07/18/2023
system/config/security.yaml+1 −0 modified@@ -32,6 +32,7 @@ xss_dangerous_tags: - base uploads_dangerous_extensions: - php + - phar - html - htm - js
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/advisories/GHSA-f6g2-h7qv-3m5vghsaADVISORY
- github.com/getgrav/grav/commit/e3b0aa0c502aad251c1b79d1ee973dcd93711f07ghsax_refsource_MISCWEB
- github.com/getgrav/grav/security/advisories/GHSA-f6g2-h7qv-3m5vghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.