https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 21:54:17 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352442 EUVD-2026-352442 https://cve.radiocsirt.org/vuln/euvd-2026-352442 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72819 <p>Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.</p> <p>Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72819 https://cve.radiocsirt.org/vuln/ghsa-r94f-hx44-8jqf <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav&#39;s built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair of values instead, it is not examined at all and is passed as safe. Pointing such a field at the routine that unpacks ZIP archives writes a PHP file from an uploaded archive into the site&#39;s public folder, which the server then runs.</p> <p>### Details</p> <p>The check rejects known-dangerous routines and, for those belonging to a component, allows only a short approved list. Both of those cases only apply when the name arrives as a single string. The same routine can be named as a pair (the component and the routine inside it), and in that form the check matches neither case, skips both lists and answers &#34;safe&#34;. Grav then calls it, with arguments the attacker supplies in the same field. Any routine shipped with Grav becomes callable.</p> <p>The one used here is what Grav runs when installing a plugin from an archive. It takes an archive and a destination folder. It does check the names of the files inside, so an archive cannot escape with `../`, but the destination is used exactly as given, so naming the folder the website is served from drops the contents there. Getting the archive in is trivial: ZIP is an accepted upload type and the files inside are never examined, so an archive containing a PH…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav&#39;s built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair of values instead, it is not examined at all and is passed as safe. Pointing such a field at the routine that unpacks ZIP archives writes a PHP file from an uploaded archive into the site&#39;s public folder, which the server then runs.</p> <p>### Details</p> <p>The check rejects known-dangerous routines and, for those belonging to a component, allows only a short approved list. Both of those cases only apply when the name arrives as a single string. The same routine can be named as a pair (the component and the routine inside it), and in that form the check matches neither case, skips both lists and answers &#34;safe&#34;. Grav then calls it, with arguments the attacker supplies in the same field. Any routine shipped with Grav becomes callable.</p> <p>The one used here is what Grav runs when installing a plugin from an archive. It takes an archive and a destination folder. It does check the names of the files inside, so an archive cannot escape with `../`, but the destination is used exactly as given, so naming the folder the website is served from drops the contents there. Getting the archive in is trivial: ZIP is an accepted upload type and the files inside are never examined, so an archive containing a PH…</p> https://cve.radiocsirt.org/vuln/ghsa-r94f-hx44-8jqf