CVE-2026-56700— Grav 反序列化注入漏洞

Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Grav 反序列化注入漏洞

Grav Grav是Grav组织开源的一个基于文件系统的无数据库内容管理系统。 Grav 2.0.0-beta.2之前版本存在安全漏洞，该漏洞源于Scheduler\JobQueue、Framework\Cache\Adapter\FileCache和Session中的不安全unserialize()调用反序列化不受信任数据且未限制允许类，结合小工具链导致PHP对象注入和任意代码执行；同时InstallCommand的git clone操作将branch、url和path参数未转义传入shell命令，允许

N/A

N/A