Return of Wrong Status Code in Grav CMS - CVE-2023-37897
Published: July 18, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU130047
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-37897
CWE-ID: CWE-393
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to return of wrong status code in isDangerousFunction() when processing Twig |map input containing a double backslash. A remote privileged user can submit a specially crafted Twig payload to execute arbitrary code.
Exploitation requires access to the Admin panel with page create or update permissions and Twig processing enabled for the modified page.
Affected software
Grav CMS
How to mitigate CVE-2023-37897
Install security update from vendor's website.
Grav CMS - update to 1.7.42.2