CVE-2024-27923

Deeper analysis

Grav is a PHP-based content management system. CVE-2024-27923 affects versions prior to 1.7.43 and stems from missing permission checks combined with insufficient filename validation on the frontmatter feature. Any authenticated user permitted to create or edit pages can therefore supply crafted frontmatter that results in arbitrary file writes, enabling remote code execution. The issue is tracked under CWE-287 (improper authentication) and CWE-434 (unrestricted file upload).

An attacker needs only low-privileged page-author access and network reachability to the Grav instance; successful exploitation grants the ability to write PHP files into web-accessible directories and subsequently execute arbitrary code under the web-server user context. The CVSS 3.1 score of 8.8 reflects the combination of network attack vector, low complexity, and full confidentiality-integrity-availability impact without user interaction.

The official fix is delivered in Grav 1.7.43; the referenced GitHub Security Advisory GHSA-f6g2-h7qv-3m5v and associated commit e3b0aa0c502aad251c1b79d1ee973dcd93711f07 contain the patch that adds proper permission and filename validation. Administrators should upgrade immediately and verify that page-author roles are restricted to trusted users.

EPSS for the vulnerability rose from a low baseline to a peak of 0.0882 (current value 0.0512), indicating measurable post-disclosure exploitation interest that warrants renewed attention from defenders.