{"cve":"CVE-2023-34253","nvd":{"published":"2023-06-14T23:15:11.037","modified":"2026-06-17T06:03:13.727","status":"Modified","description":"Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-94","CWE-184","CWE-1336"],"references":["https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190","https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b","https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm","https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/","https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83"],"products":["getgrav:grav"],"source":"nvd","synced_at":"2026-10-19T21:38:24.161619714+00:00"},"epss":{"cve":"CVE-2023-34253","score":0.02074,"percentile":0.81465,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}