Grav CMS versions prior to 2.0.19 contain a critical remote code execution vulnerability that allows authenticated users with page-write access to execute arbitrary PHP code.

The vulnerability exists in the Twig sort filter where the sortFunc wrapper incorrectly disables sandboxing. This allows an authenticated user with page-write privileges to invoke the spl_autoload function, which can be leveraged to trigger arbitrary PHP code execution on the server.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary code with the permissions of the web server user. This level of access typically results in a total compromise of the application, potential data exfiltration, and the ability to pivot into the underlying server infrastructure. With a CVSS score of 8.8, this flaw represents a high-risk security event that requires immediate attention to prevent full system takeover.

Immediate Action: Update Grav CMS to version 2.0.19 or later immediately to apply the necessary security patches and restrict the Twig sort filter functionality.

Proactive Monitoring: Review web server and application logs for suspicious entries involving Twig filter usage or unexpected file inclusion attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block malicious payloads targeting PHP template engines or anomalous input in form frontmatter.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability poses a severe threat to the integrity and availability of the Grav CMS environment. Administrators must prioritize updating to version 2.0.19 as soon as possible to neutralize the risk of arbitrary code execution. Continuous monitoring of administrative actions and application logs is advised until the update is fully deployed across all instances.