VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 6, 2025· Updated Aug 7, 2025

CVE-2025-50286

CVE-2025-50286

Description

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Grav/CMSdescription
  • Kalmia/CMSllm-fuzzy
    Range: =1.7.48

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.