https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 19:26:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-361335 EUVD-2026-361335 https://cve.radiocsirt.org/vuln/euvd-2026-361335 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72702 <p>Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site&#39;s origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.</p> <p>Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site&#39;s origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72702 https://cve.radiocsirt.org/vuln/ghsa-9ccq-2jfg-qw33 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>`Grav\Common\Uri::referrer()` and `Grav\Common\Page\Pages::referrerRoute()` both check whether an incoming request&#39;s `Referer` header &#34;came from our site&#34; using `str_starts_with($referrer, $base)`, where `$base` is the site&#39;s own absolute root URL (for example `https://example.com`, no trailing slash). Because the comparison has no boundary character after the prefix, any `Referer` value that merely starts with that string is accepted, including a `Referer` from a completely different host such as `https://example.com.attacker.tld`.</p> <p>This is the same class of bug already fixed once in 2.0.15 for the fast static asset server (GHSA-4v9q-p283-qc2m, &#34;also allowing any neighbouring directory whose name starts with the same letters&#34;). The identical pattern is still present in both places that trust the `Referer` header, and neither is covered by that fix.</p> <p>## Affected product and version</p> <p>Product: Grav CMS, getgrav/grav Confirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3 The pattern is not touched by any of the 2.0.15 security fixes, so earlier 2.x releases are likely affected too. I have not checked how far back it goes.</p> <p>## Affected code</p> <p>`system/src/Grav/Common/Uri.php`, method `referrer()`: ```php $referrer = $_SERVER[&#39;HTTP_REFERER&#39;] ?? null; ... $base = $this-&gt;rootUrl(true); // e.g. &#34;https://example.com&#34;, no trailing slash // Referrer should always have host set and it should come from the same base address. if (!is_string($referrer) ||…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>`Grav\Common\Uri::referrer()` and `Grav\Common\Page\Pages::referrerRoute()` both check whether an incoming request&#39;s `Referer` header &#34;came from our site&#34; using `str_starts_with($referrer, $base)`, where `$base` is the site&#39;s own absolute root URL (for example `https://example.com`, no trailing slash). Because the comparison has no boundary character after the prefix, any `Referer` value that merely starts with that string is accepted, including a `Referer` from a completely different host such as `https://example.com.attacker.tld`.</p> <p>This is the same class of bug already fixed once in 2.0.15 for the fast static asset server (GHSA-4v9q-p283-qc2m, &#34;also allowing any neighbouring directory whose name starts with the same letters&#34;). The identical pattern is still present in both places that trust the `Referer` header, and neither is covered by that fix.</p> <p>## Affected product and version</p> <p>Product: Grav CMS, getgrav/grav Confirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3 The pattern is not touched by any of the 2.0.15 security fixes, so earlier 2.x releases are likely affected too. I have not checked how far back it goes.</p> <p>## Affected code</p> <p>`system/src/Grav/Common/Uri.php`, method `referrer()`: ```php $referrer = $_SERVER[&#39;HTTP_REFERER&#39;] ?? null; ... $base = $this-&gt;rootUrl(true); // e.g. &#34;https://example.com&#34;, no trailing slash // Referrer should always have host set and it should come from the same base address. if (!is_string($referrer) ||…</p> https://cve.radiocsirt.org/vuln/ghsa-9ccq-2jfg-qw33