Vulnerability record · CVE-2024-27921 · published 21 March 2024
CVE-2024-27921: Grav CMS file upload path traversal allows arbitrary file write
Getgrav · Grav
Grav, an open-source flat-file CMS, contains a path traversal flaw in its file upload handling in versions prior to 1.7.45. An attacker can write or overwrite files with extensions such as .json, .zip, .css and .gif outside the intended upload directory. Because Grav is flat-file, overwriting configuration or backup files can lead to code injection and data exposure.
Description
Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with high EPSS and a vendor advisory tagged as exploit, but exploitation requires an authenticated low-privileged account and no KEV listing exists.
What it is
Grav, an open-source flat-file CMS, contains a path traversal flaw in its file upload handling in versions prior to 1.7.45. An attacker can write or overwrite files with extensions such as .json, .zip, .css and .gif outside the intended upload directory. Because Grav is flat-file, overwriting configuration or backup files can lead to code injection and data exposure.
Impact
An attacker gains the ability to create or replace arbitrary files on the server, which can enable injection of code, corruption of backup files, and exfiltration of sensitive data via CSS-based techniques.
Attack surface
The flaw is reachable over the network through the file upload functionality, requiring the attacker to hold a low-privileged authenticated account; no user interaction is needed per the CVSS vector.
Exploitation
No CISA KEV listing and no ransomware association are recorded, but EPSS is high at roughly 0.61 (99th percentile) and the vendor advisory is tagged as an exploit reference, indicating public exploit material exists.
What to do
- Upgrade Grav to version 1.7.45 or later, which contains the patch commit 5928411b86bab05afca2b33db4e7386a44858e99.
- Restrict file upload permissions and validate uploaded filenames and extensions server-side if immediate upgrade is not possible.
- Limit authenticated accounts that can reach upload functionality and review account privileges.
- Monitor and restore Grav configuration and backup files from known-good copies if tampering is suspected.
Detection
- Alert on file creation or modification events in Grav directories involving extensions such as .json, .zip, .css or .gif outside expected upload paths.
- Review web server logs for upload requests containing traversal sequences such as ../ or encoded variants.
- Monitor for unexpected changes to Grav configuration and backup files and compare against known-good baselines.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-27921 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-27921), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
