GHSA-729w-j79f-2c34
Grav may be vulnerable to SSRF attack via Twig Templates
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | getgrav/grav | <= 1.7.49.5 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.
References
External links from the advisory. They lead to third-party sites.