Grav CMS version 1.7.48 is vulnerable to remote code execution, which allows an administrator to achieve full system compromise through malicious plugin uploads.

This vulnerability involves the improper handling of plugin uploads via the /admin/tools/direct-install interface. It requires an attacker to possess administrative credentials to trigger the execution of arbitrary PHP code and establish a reverse shell.

Successful exploitation allows an attacker to gain complete control over the web server, leading to potential data exfiltration, system defacement, or the deployment of persistent backdoors. Given the CVSS score of 8.1, this vulnerability poses a high risk to the confidentiality, integrity, and availability of the hosting environment. Organizations relying on this CMS for critical content delivery must treat this as a high-priority remediation task to prevent unauthorized server access.

Immediate Action: Update Grav CMS to a patched version that addresses the insecure handling of the direct-install plugin interface.

Proactive Monitoring: Review web server access logs for suspicious activity targeting the /admin/tools/direct-install endpoint and monitor for unexpected outbound network connections indicative of a reverse shell.

Compensating Controls: Implement strict access control lists for the administrative dashboard and utilize a Web Application Firewall to block unauthorized or irregular file upload requests.

Public Exploit Available: Yes, a Metasploit module and an ExploitDB entry exist.

The severity of this remote code execution flaw requires immediate attention from security administrators. Because a weaponized exploit is publicly available, the risk of automated or targeted attack is elevated. Administrators should verify their current version of Grav CMS and apply the necessary updates or security hardening measures immediately to prevent potential system compromise.