https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:05:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-196424 EUVD-2026-196424 https://cve.radiocsirt.org/vuln/euvd-2026-196424 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37897 <p>Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-37897 https://cve.radiocsirt.org/vuln/ghsa-9436-3gmp-4f53 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary The fix for SSTI using `|map`, `|filter` and `|reduce` twigs implemented in the commit [71bbed1](https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b) introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`)</p> <p>### Details The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`.</p> <p>```php ... if (strpos($name, &#34;\\&#34;) !== false) { return false; }</p> <p>if (in_array($name, $commandExecutionFunctions)) { return true; } ... ``` Based on the code where the function is used, it is expected that any dangerous condition would return `true` ```php /** * @param Environment $env * @param array $array * @param callable|string $arrow * @return array|CallbackFilterIterator * @throws RuntimeError */ function mapFunc(Environment $env, $array, $arrow) { if (!$arrow instanceof \Closure &amp;&amp; !is_string($arrow) || Utils::isDangerousFunction($arrow)) { throw new RuntimeError(&#39;Twig |map(&#34;&#39; . $arrow . &#39;&#34;) is not allowed.&#39;); } ``` when `|map(&#39;\system&#39;)` is used in the malicious payload, the single backslash is dropped prior to reaching `strpos($name, &#39;\\&#39;)` check, thus `$name` variable already has no backslash, and the command is blacklisted because it reache…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary The fix for SSTI using `|map`, `|filter` and `|reduce` twigs implemented in the commit [71bbed1](https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b) introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`)</p> <p>### Details The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`.</p> <p>```php ... if (strpos($name, &#34;\\&#34;) !== false) { return false; }</p> <p>if (in_array($name, $commandExecutionFunctions)) { return true; } ... ``` Based on the code where the function is used, it is expected that any dangerous condition would return `true` ```php /** * @param Environment $env * @param array $array * @param callable|string $arrow * @return array|CallbackFilterIterator * @throws RuntimeError */ function mapFunc(Environment $env, $array, $arrow) { if (!$arrow instanceof \Closure &amp;&amp; !is_string($arrow) || Utils::isDangerousFunction($arrow)) { throw new RuntimeError(&#39;Twig |map(&#34;&#39; . $arrow . &#39;&#34;) is not allowed.&#39;); } ``` when `|map(&#39;\system&#39;)` is used in the malicious payload, the single backslash is dropped prior to reaching `strpos($name, &#39;\\&#39;)` check, thus `$name` variable already has no backslash, and the command is blacklisted because it reache…</p> https://cve.radiocsirt.org/vuln/ghsa-9436-3gmp-4f53 https://cve.radiocsirt.org/vuln/gsd-2023-37897 gsd-2023-37897 https://cve.radiocsirt.org/vuln/gsd-2023-37897