CVE-2024-27921 Grav File Upload Path Traversal vulnerability

What is CVE-2024-27921?

CVE-2024-27921 is a high-severity path traversal vulnerability in Getgrav Grav, published on 21 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.

Weakness: CWE-22

Which versions are affected by CVE-2024-27921?

2 open source packages ship an affected version, including getgrav/grav. It affects 1 product.

Products include Getgrav Grav.

How do I fix CVE-2024-27921?

Upgrade getgrav/grav to 1.7.45 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-27921 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27921 exists.

Other vulnerabilities in Getgrav Grav

• CVE-2023-34251 Grav Server Side Template Injection vulnerability Critical 10.0
• CVE-2025-46199 Cross-site scripting in n/a Critical 9.8
• CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) Critical 9.3
• CVE-2025-66844 Grav may be vulnerable to SSRF attack via Twig Templates Critical 9.1
• CVE-2022-2073 Code Injection in getgrav/grav Critical 9.1

All Getgrav Grav vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m7hx-hw6h-mqmc.