High severityNVD Advisory· Published Mar 6, 2024· Updated Aug 2, 2024
Remote Code Execution by uploading a phar file using frontmatter
CVE-2024-27923
Description
Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
getgrav/gravPackagist | < 1.7.43 | 1.7.43 |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-f6g2-h7qv-3m5vghsaADVISORY
- github.com/getgrav/grav/commit/e3b0aa0c502aad251c1b79d1ee973dcd93711f07ghsax_refsource_MISCWEB
- github.com/getgrav/grav/security/advisories/GHSA-f6g2-h7qv-3m5vghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.