Skip to content
Fencer Vulns
high 8.8

CVE-2023-34448 json

Grav Server-side Template Injection (SSTI) via Twig Default Filters

published 2023-06-14 3 y ago modified 2026-09-10 1 mo ago also GHSA-whr7-m3f8-mpm8 , EUVD-2023-1902

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.5%
EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.

Patch / fix

  • packagist getgrav/grav 1.7.42
  • getgrav grav 1.7.42

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
22 mo ago

Exploit prediction

4.52% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83 referenced PoC, tagged "exploit" by a source, unverified
  • huntr.dev https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist getgrav/grav
<1.7.42
1.7.42

Affected products

  • getgrav grav

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.