CVE-2024-28116: Getgrav Grav SSTI RCE Vulnerability

CVE-2024-28116 Overview

Grav CMS versions prior to 1.7.45 contain a Server-Side Template Injection (SSTI) vulnerability in the Twig template engine. Authenticated users with editor permissions can bypass the existing security sandbox and execute arbitrary code on the remote server. The flaw is tracked as CWE-94: Improper Control of Generation of Code and stems from an incomplete deny list of unsafe Twig functions. The vendor released a patch in Grav 1.7.45 that adds twig.safe_functions to the blocked pattern set.

Critical Impact
Any authenticated editor can achieve remote code execution on the underlying host, leading to full compromise of the Grav CMS instance and its data.

Affected Products

Getgrav Grav CMS versions prior to 1.7.45
All Grav installations exposing the admin editor to low-privilege users
Deployments relying solely on the Twig security sandbox for isolation

Discovery Timeline

2024-03-21 - CVE-2024-28116 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28116

Vulnerability Analysis

Grav CMS renders content through the Twig templating engine and enforces a security sandbox that filters dangerous constructs before evaluation. The filter in system/src/Grav/Common/Security.php maintained a deny list of Twig functions such as undefined_functions, twig.getFunction, and core.setEscaper. The list omitted twig.safe_functions, which allows a template author to register arbitrary PHP callables as safe for execution inside Twig. An authenticated editor can craft page content that invokes twig.safe_functions and reintroduces functions like system, exec, or passthru into the rendering context. Rendering the page then executes attacker-supplied PHP code under the web server user, defeating the sandbox entirely.

Root Cause

The root cause is an incomplete blocklist in the Twig content sanitizer. The preg_replace pattern that comments out dangerous Twig tags did not include the twig.safe_functions extension entry point, leaving a documented Twig capability reachable from user-authored content.

Attack Vector

Exploitation requires network access to the Grav admin interface and valid credentials with editor permissions. The attacker submits a page, module, or template containing a malicious Twig expression that calls twig.safe_functions to expose native PHP functions. When Grav renders the page, the attacker's PHP payload runs on the server, yielding remote code execution and full host compromise.

php

             'undefined_functions',
             'twig.getFunction',
             'core.setEscaper',
+            'twig.safe_functions',
         ];
         $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
         return $string;

Source: Grav commit 4149c81 — the patch adds twig.safe_functions to the $bad_twig deny list so the sanitizer wraps matching expressions in Twig comments before rendering.

Detection Methods for CVE-2024-28116

Indicators of Compromise

Twig expressions containing twig.safe_functions, getFunction, or setEscaper inside stored page content, modules, or template overrides.
New or modified .md, .yaml, or .twig files under user/pages/ and user/themes/ written by the web server user outside of normal editorial workflows.
Web shells, cron entries, or outbound reverse shells originating from the PHP-FPM or Apache process hosting Grav.

Detection Strategies

Scan Grav content directories for the string safe_functions and other Twig sandbox-bypass tokens across all page revisions.
Review Grav admin audit logs for editor accounts creating or updating pages immediately before suspicious child processes of the web server appear.
Alert on the web server process spawning shell interpreters such as sh, bash, or powershell, which indicates PHP-based command execution.

Monitoring Recommendations

Ingest web server, PHP, and Grav admin logs into a centralized SIEM to correlate editor activity with process execution telemetry.
Baseline outbound network connections from the Grav host and alert on new destinations that follow content edits.
Monitor filesystem integrity under user/ and system/ directories to detect unauthorized template changes.

How to Mitigate CVE-2024-28116

Immediate Actions Required

Upgrade Grav CMS to version 1.7.45 or later on every instance, including staging and disaster-recovery copies.
Audit all accounts with editor permissions or higher and revoke access for unused or shared accounts.
Review stored pages, modules, and theme templates for Twig expressions referencing safe_functions, getFunction, or setEscaper and remove them.

Patch Information

The vendor fix is available in Grav 1.7.45 and documented in the GitHub Security Advisory GHSA-c9gp-64c4-2rrh. The corresponding source change is in commit 4149c81, which extends the $bad_twig deny list in system/src/Grav/Common/Security.php to include twig.safe_functions.

Workarounds

Restrict admin panel access to trusted networks using firewall rules or a reverse proxy allow list until patching completes.
Enforce strong, unique credentials and multi-factor authentication for every Grav admin account to reduce the pool of potential abusers.
Run the Grav PHP process under a dedicated low-privilege user with restricted filesystem and outbound network permissions to contain post-exploitation impact.

bash

# Upgrade Grav CMS to the patched release
cd /path/to/grav
php bin/gpm selfupgrade
php bin/gpm update
php bin/grav clear-cache
grep -R "safe_functions" user/pages user/themes user/plugins || echo "No matches found"