CVE-2023-34253

Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.

• CWE-184
• CWE-1336
• CWE-94

• https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190Issue Tracking
• https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1bPatch
• https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgmExploit, Vendor Advisory
• https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/Exploit, Third Party Advisory
• https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83Patch
• https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190Issue Tracking
• https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1bPatch
• https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgmExploit, Vendor Advisory
• https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/Exploit, Third Party Advisory
• https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83Patch

Published

Jun 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34247Keystone is a content management system for Node.JS. There i…4.1
• CVE-2023-34249benjjvi/PyBB is an open source bulletin board. Prior to comm…9.8
• CVE-2023-3425Out-of-bounds read issue in M-Files Server versions below 23…5.3
• CVE-2023-34250Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2023-34251Grav is a flat-file content management system. Versions prio…7.2
• CVE-2023-34252Grav is a flat-file content management system. Prior to vers…7.2
• CVE-2023-34254The GLPI Agent is a generic management agent. Prior to versi…7.2
• CVE-2023-34255Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-34256An issue was discovered in the Linux kernel before 6.3.3. Th…5.5
• CVE-2023-34257An issue was discovered in BMC Patrol through 23.1.00. The a…9.8
• CVE-2023-34258An issue was discovered in BMC Patrol before 22.1.00. The ag…7.5
• CVE-2023-34259Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 al…4.9