Grav Server-side Template Injection (SSTI) via Twig Default Filters
No sign of exploitation. No public exploitation artifact known so far.
Grav CMS has a template injection vulnerability where attackers can run arbitrary code through Twig's built-in functions like map() and reduce(), even though a previous patch tried to fix a similar issue. This allows remote code execution if an attacker can control template input.
Server-side template injection (SSTI) in Grav versions before 1.7.42 enables remote code execution through unsafe Twig Core Extension functions (map, reduce filters). The vulnerability exists because the previous CVE-2022-2073 patch only blocked the filter() function but failed to validate arguments in other dangerous built-in functions. An attacker with the ability to inject template code can exploit the unvalidated $arrow parameter to invoke arbitrary functions.