{"cve":"CVE-2021-21425","nvd":{"published":"2021-04-07T19:15:12.190","modified":"2026-06-17T03:35:33.067","status":"Modified","description":"Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-284"],"references":["http://packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.html","http://packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.html","https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pj","https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/","http://packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.html"],"products":["getgrav:grav-plugin-admin"],"source":"nvd","synced_at":"2026-10-19T21:17:01.373894544+00:00"},"epss":{"cve":"CVE-2021-21425","score":0.806,"percentile":0.99625,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}