Grav Server-side Template Injection (SSTI) via Twig Default Filters

Grav CMS has a template injection vulnerability where attackers can run arbitrary code through Twig's built-in functions like map() and reduce(), even though a previous patch tried to fix a similar issue. This allows remote code execution if an attacker can control template input.

Server-side template injection (SSTI) in Grav versions before 1.7.42 enables remote code execution through unsafe Twig Core Extension functions (map, reduce filters). The vulnerability exists because the previous CVE-2022-2073 patch only blocked the filter() function but failed to validate arguments in other dangerous built-in functions. An attacker with the ability to inject template code can exploit the unvalidated $arrow parameter to invoke arbitrary functions.