Arbitrary File Write in Grav CMS via Twig Template Processing

Executive Summary

This is a high-severity arbitrary file write vulnerability in Grav CMS versions before 9.1.8. It affects the Form plugin's process.save.filename parameter. The issue is a Time-of-Check Time-of-Use (TOCTOU) race condition where path traversal is validated before Twig processing but not after rendering. Attackers can exploit this to write arbitrary files, including PHP webshells, to sensitive directories by submitting malicious form data processed through Twig templates.

Useful 0 Not Useful 0

Impact Analysis

An attacker with editor privileges or API access could exploit this to write malicious files to your web server. This includes PHP webshells that allow remote code execution, overwriting plugin files to maintain persistence, or writing sensitive files like SSH keys. The attack requires minimal privileges and can be triggered by any form submission, making it highly dangerous for unpatched Grav installations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or system compromise, which may violate GDPR's integrity and confidentiality requirements or HIPAA's security rules. Organizations using vulnerable Grav versions may face compliance violations, regulatory fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS version with: grep -r "version" /path/to/grav/system/version.yaml. If version <= 9.1.7, the system is vulnerable. Inspect Form plugin files for unusual filenames or recent PHP files in web root directories like /var/www/html/. Monitor for unexpected file writes in user/data/ and plugin directories.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to version 9.1.8 or later immediately. Temporarily disable the Form plugin if not essential. Restrict file write permissions in web directories. Review recent file modifications in /user/data/ and web root for unauthorized files. Implement strict input validation for form submissions.

Useful 0 Not Useful 0