A critical authorization bypass in the Grav API plugin allows unauthenticated attackers to execute arbitrary code on the server.

This vulnerability involves a missing authorization check within the PagesController::guardTwigContent function. An unauthenticated attacker can manipulate API key scopes to enable Twig processing, leading to server-side template injection and remote code execution.

Successful exploitation grants an attacker full control over the web server hosting the Grav instance. This can lead to complete data compromise, unauthorized modification of site content, and potential lateral movement within the network. Given the CVSS score of 9.8, the risk to confidentiality, integrity, and availability is considered critical.

Immediate Action: Update the Grav API plugin to version 1.0.13 or later immediately.

Proactive Monitoring: Monitor server logs for unusual API requests or patterns suggesting attempted injection of Twig syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious template injection payloads.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the Grav API plugin to version 1.0.13 to eliminate the risk of remote code execution. Failure to patch may expose the system to high-impact attacks.