CVE-2021-21425: Grav Admin Plugin unauthenticated access control allows YAML write and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable access control flaw with high confidentiality, integrity and availability impact and very high EPSS score.

What it is

Grav Admin Plugin 1.10.7 and earlier lets an unauthenticated user invoke administrator controller methods without credentials. Those calls can create or modify arbitrary YAML files, changing site configuration and enabling further compromise. The flaw is fixed in 1.10.8.

Impact

An attacker can alter site configuration, hijack an administrator account, or execute operating system commands as the web-server user.

Attack surface

Reachable over the network through the Grav Admin Plugin interface, with no authentication and no user interaction required per the CVSS vector. Blocking access to the /admin path from untrusted sources is noted as a workaround.

Exploitation

Not listed in CISA KEV, but EPSS is 0.806 (99.6th percentile) and public references include an exploit write-up and Packet Storm RCE postings, indicating active interest and available exploit detail.

What to do

• Upgrade Grav Admin Plugin to 1.10.8 or later.
• Block access to the /admin path from untrusted sources as an interim workaround.
• Restrict network exposure of the Grav admin interface to trusted management networks or VPN.
• Review and restore YAML configuration files for unauthorized changes after any suspected exposure.
• Rotate administrator credentials and review accounts for signs of hijacking.

Detection

• Monitor web logs for unauthenticated requests to /admin endpoints, especially administrator controller methods.
• Alert on unexpected creation or modification of YAML files under the Grav configuration directories.
• Look for suspicious scheduler job definitions or configuration changes in Grav.
• Hunt for web-server user processes spawning shell or command interpreters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.