Grav CMS contains multiple critical vulnerabilities, including insecure deserialization and command injection, which can lead to full remote code execution.

The CMS fails to restrict classes during PHP object deserialization and lacks proper sanitization for shell commands during plugin installation. These flaws allow an attacker to achieve arbitrary code execution, with the command injection specifically requiring administrative access to trigger.

The CVSS score of 9.8 reflects the high probability of total system takeover. Successful exploitation allows for complete remote code execution, granting attackers the ability to exfiltrate database contents, modify web content, or pivot into the internal network, causing significant security and compliance failures.

Immediate Action: Upgrade Grav CMS to version 2.0.0-beta.2 or the latest stable release to patch the deserialization and injection flaws.

Proactive Monitoring: Monitor server logs for unusual process execution, unexpected file modifications, or anomalous activity within the CMS administration panel.

Compensating Controls: Restrict administrative access to the Grav CMS dashboard to trusted IP addresses only and ensure the server runs with the least privilege necessary to mitigate command execution impact.

Public Exploit Available: Unknown

Due to the severity of these code execution flaws, immediate patching is required. Administrators should verify their current version of Grav CMS and perform an emergency update, as these vulnerabilities provide a direct path for attackers to gain full control over the web server environment.