Description

Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system.

PoC video.

Proof of Concept

Payload:

{{['cat\x20/etc/passwd']|filter('system')}}

1. With an authenticated user, access the admin panel.
2. Edit a page, enabling Twig in the Advanced tab.
3. Put the payload in the content.
4. Save and check out the post.