CVE-2024-28117

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Upgrading to patched version 1.7.45 can mitigate this issue.

• CWE-94
• CWE-94

• https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fePatch
• https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rvExploit, Vendor Advisory
• https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fePatch
• https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rvExploit, Vendor Advisory

Published

Mar 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28111Canarytokens helps track activity and actions on a network. …6.5
• CVE-2024-28112Peering Manager is a BGP session management tool. Affected v…4.8
• CVE-2024-28113Peering Manager is a BGP session management tool. In Peering…6.1
• CVE-2024-28114Peering Manager is a BGP session management tool. There is a…9.1
• CVE-2024-28115FreeRTOS is a real-time operating system for microcontroller…7.8
• CVE-2024-28116Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28118Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28119Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-2812A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20…8.8
• CVE-2024-28120codeium-chrome is an open source code completion plugin for …7.5
• CVE-2024-28121stimulus_reflex is a system to extend the capabilities of bo…8.8
• CVE-2024-28122 JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/…6.8