A critical remote code execution vulnerability in Grav CMS versions prior to 2.0.13 permits authenticated users to gain unauthorized command execution on the host server.

This vulnerability, categorized as CWE-94, involves improper control of code generation during the processing of ZIP file uploads. An authenticated user with sufficient privileges can upload a crafted archive to achieve remote code execution on the underlying server.

With a CVSS score of 8.8, this vulnerability represents a severe threat to the entire server environment. An attacker achieving remote code execution can steal sensitive data, modify application files, or pivot deeper into the corporate network, leading to significant reputational and financial damage.

Immediate Action: Update Grav CMS to version 2.0.13 or later immediately.

Proactive Monitoring: Inspect server logs for suspicious file upload activity or unexpected execution of system commands by the web server user.

Compensating Controls: Ensure that the web application directory has restricted permissions and that the web server is configured to prevent the execution of scripts in upload directories.

Public Exploit Available: Unknown.

The risk of remote code execution requires immediate attention. Organizations utilizing Grav CMS must upgrade to the patched version 2.0.13 without delay to eliminate the underlying code injection vector.