A critical host header injection vulnerability in Grav allows unauthenticated remote attackers to manipulate system-generated emails, posing a significant risk of social engineering or phishing.

This vulnerability (CWE-350) stems from the application's reliance on reverse DNS resolution for security-critical actions, specifically within the email invitation process. The flaw is exploitable by unauthenticated remote attackers who can influence the application logic via malicious host headers.

Successful exploitation allows attackers to redirect sensitive application-generated emails to unauthorized destinations. This compromise of communication integrity can lead to unauthorized account access, credential theft, or the distribution of malicious content to legitimate users, severely damaging organizational reputation. With a CVSS score of 7.5, this vulnerability represents a high-severity risk to system security.

Immediate Action: Update the Grav installation to version 3.9.2 or later to apply the necessary security patches.

Proactive Monitoring: Monitor outgoing email logs for unexpected recipient addresses or anomalous traffic patterns originating from the Grav mailer service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and sanitize the Host header in incoming HTTP requests to prevent injection attempts.

Public Exploit Available: No (exploit_available: false)

The reliance on insecure DNS resolution for security functions is a critical design flaw. Administrators should prioritize the update to version 3.9.2 immediately to neutralize this vector. Failure to patch leaves the platform vulnerable to manipulation of its automated messaging systems.