CVE-2023-37897 Server-side Template Injection (SSTI) in grav
An attacker with admin or page-editing privileges can execute arbitrary code via a Server-Side Template Injection bypass in Grav CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-37897?
CVE-2023-37897 is a high-severity code injection vulnerability in Getgrav Grav, published on 18 Jul 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2023-37897?
2 open source packages ship an affected version, including getgrav/grav. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 1.7.42.2 |
getgrav/grav Packagist | All versions | 1.7.42.2 |
Products include Getgrav Grav.
How do I fix CVE-2023-37897?
Upgrade getgrav/grav to 1.7.42.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-37897 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37897 exists.
Other vulnerabilities in Getgrav Grav
- CVE-2023-34251 Grav Server Side Template Injection vulnerability
- CVE-2025-46199 Cross-site scripting in n/a
- CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
- CVE-2025-66844 Grav may be vulnerable to SSRF attack via Twig Templates
- CVE-2022-2073 Code Injection in getgrav/grav
Sources
Also known as GHSA-9436-3gmp-4f53.