Improper access control in Grav CMS - CVE-2024-34082
Published: May 15, 2024 / Updated: May 5, 2026
Vulnerability identifier: #VU130050
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-34082
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Grav CMS
Affected software:
Grav CMS
Grav CMS
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the Twig template processing functionality when rendering user-supplied page content. A remote user can inject Twig syntax that reads arbitrary server files to disclose sensitive information.
Exploitation requires a low-privilege account with page edit privilege. Exposed account files may contain hashed passwords, 2FA secrets, and password reset tokens, which can enable account takeover of other users.
How to mitigate CVE-2024-34082
Install security update from vendor's website.