CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
Unauthenticated attackers can write arbitrary YAML and execute PHP code via the scheduler endpoint in GravCMS, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47812?
CVE-2021-47812 is a critical missing authorization vulnerability in Getgrav Grav, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.
Weakness: CWE-862
Which versions are affected by CVE-2021-47812?
It affects 1 product.
Products include Getgrav Grav.
How do I fix CVE-2021-47812?
No fix has been published for CVE-2021-47812 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-47812 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47812 exists.
Other vulnerabilities in Getgrav Grav
Sources
Also known as GHSA-474v-g7v9-75hp.