Grav's Twig processing allowing dangerous PHP functions by default
Impact
Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.
Patches
The issue was addressed by preventing dangerous functions from being called in Twig templates. A configuration option has been added to manually allow arbitrary PHP functions (system.twig.safe_functions) and filters (system.twig.safe_filters).
Futures major versions of Grav may disable this functionality by default.
Workarounds
Blocking access to the /admin path from untrusted sources will reduce the probability of exploitation.
References
- https://portswigger.net/research/server-side-template-injection
- https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
For more information
If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | getgrav/grav | < 1.7.11 | 1.7.11 |
References
- https://github.com/getgrav/grav/security/advisories/GHSA-g8r4-p96j-xfxc
- https://nvd.nist.gov/vuln/detail/CVE-2021-29440
- https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
- https://packagist.org/packages/getgrav/grav
- http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.html
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-94- Platform
- Composer
- Package
getgrav/grav- Disclosed
- 16.04.2021
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-g8r4-p96j-xfxc - CC BY 4.0
Vulnerability history: getgrav/grav
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 99
- First → latest
- 11.2019 09.2026
- Without a fix
- 6
- Exploited in attacks
- 0
Severity breakdown
- Critical 7
- High 47
- Medium 41
- Low 4
Disclosures per year
- 2019: 1
- 2020: 1
- 2021: 4
- 2022: 10
- 2023: 5
- 2024: 8
- 2025: 23
- 2026: 47
-
Grav's Twig processing allowing dangerous PHP functions by default this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.