GHSA-8535-hvm8-2hmv
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | getgrav/grav | < 1.8.0-beta.27 | 1.8.0-beta.27 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
Having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload. Sensitive information may be contained in the configuration details.
### PoC
Create a simple form with two fields, 'registration-number' and 'hp'. Add a submit button and set the method to POST(screenshot attached below). Form name set to 'hero-form'. Send a POST request with the following payload and you will notice a response with a php array listing the whole Grav configuration details - including plugins(screenshot attached).
registration-number:d643aaaa
hp:vJyifp
__form-name__:hero-form
__unique_form_id__:{{var_dump(_context|slice(0,7))}}
### Impact
Server-Side Template (SST) vulnerability. The vulnerability affects the latest Grav version as of 25th of Match 2025 (1.7.48) with all plugins installed (including forms plugin v.7.4.2) to their latest versions as well.
References
External links from the advisory. They lead to third-party sites.