CVE-2021-29440

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
getgrav	grav	< 1.7.11

References

http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilitiesExploit, Third Party Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-g8r4-p96j-xfxcThird Party Advisory
https://packagist.org/packages/getgrav/gravProduct, Third Party Advisory
http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilitiesExploit, Third Party Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-g8r4-p96j-xfxcThird Party Advisory
https://packagist.org/packages/getgrav/gravProduct, Third Party Advisory

Timeline

Published: Apr 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294419.8Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when con CVE-2021-294427.5Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the Conf CVE-2021-294435.9jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A1 CVE-2021-294445.9jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 CVE-2021-294455.9jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA CVE-2021-294465.9jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA CVE-2021-294476.5Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Libr CVE-2021-294488.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal,CVE-2021-294497.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were CVE-2021-294504.3Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a CVE-2021-294519.1Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Toke CVE-2021-294526.5a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in versi