Improper access control in Grav CMS - CVE-2024-34082
Published: May 15, 2024 / Updated: May 5, 2026
Vulnerability identifier: #VU130050
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-34082
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the Twig template processing functionality when rendering user-supplied page content. A remote user can inject Twig syntax that reads arbitrary server files to disclose sensitive information.
Exploitation requires a low-privilege account with page edit privilege. Exposed account files may contain hashed passwords, 2FA secrets, and password reset tokens, which can enable account takeover of other users.
Affected software
Grav CMS
How to mitigate CVE-2024-34082
Install security update from vendor's website.
Grav CMS - update to 1.7.46