CVE-2021-21425

Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.

• CWE-284

• http://packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.htmlThird Party Advisory, VDB Entry
• https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pjThird Party Advisory
• https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.htmlThird Party Advisory, VDB Entry
• https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pjThird Party Advisory
• https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/Exploit, Third Party Advisory

Published

Apr 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2142Vulnerability in the Oracle WebLogic Server product of Oracl…6.1
• CVE-2021-21420vscode-stripe is an extension for Visual Studio Code. A vuln…7.8
• CVE-2021-21421node-etsy-client is a NodeJs Etsy ReST API Client. Applicati…6.5
• CVE-2021-21422mongo-express is a web-based MongoDB admin interface, writte…6.1
• CVE-2021-21423`projen` is a project generation tool that synthesizes proje…8.1
• CVE-2021-21424Symfony is a PHP framework for web and console applications …5.3
• CVE-2021-21426Magento-lts is a long-term support alternative to Magento Co…9.8
• CVE-2021-21427Magento-lts is a long-term support alternative to Magento Co…7.2
• CVE-2021-21428Openapi generator is a java tool which allows generation of …7
• CVE-2021-21429OpenAPI Generator allows generation of API client libraries,…3.3
• CVE-2021-21430OpenAPI Generator allows generation of API client libraries …5.5
• CVE-2021-21431sopel-channelmgnt is a channelmgnt plugin for sopel. In vers…8.1