CVE-2024-28118

Summary

CVE-2024-28118 is a vulnerability affecting the open-source Grav content management system. Before version 1.7.45, the system allowed unrestricted access to Twig extension classes from the Grav context, enabling attackers to redefine config variables and bypass a previous Server Side Template Injection (SSTI) mitigation. With Twig processing of static pages enabled in the front matter by administrative users, an attacker could exploit this behavior to execute arbitrary code and escalate privileges on the instance. Grav has released version 1.7.45, which addresses this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.