CVE-2025-50286
📋 TL;DR
This vulnerability allows authenticated admin users in Grav CMS to upload malicious plugins through the direct-install interface, leading to arbitrary PHP code execution and potential reverse shell access. It affects Grav CMS installations with admin access enabled.
💻 Affected Systems
- Grav CMS
📦 What is this software?
Grav by Getgrav
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Unauthorized admin uploads malicious plugin, gains shell access, and compromises the web server.
If Mitigated
Limited to authenticated admin abuse with proper access controls and monitoring.
🎯 Exploit Status
Exploit requires admin credentials; GitHub repository contains working exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.7.49 or later
Vendor Advisory: https://getgrav.org/blog/security-update
Restart Required: No
Instructions:
1. Backup your Grav installation. 2. Update Grav CMS to v1.7.49 or later via GPM or manual update. 3. Clear cache. 4. Verify admin functionality.
🔧 Temporary Workarounds
Disable Admin Plugin
linuxTemporarily disable the admin plugin to prevent access to vulnerable interface.
mv user/plugins/admin user/plugins/admin.disabled
Restrict Admin Access
allLimit admin panel access to specific IP addresses via .htaccess or web server config.
# Add to .htaccess: Order Deny,Allow
Deny from all
Allow from 192.168.1.100
🧯 If You Can't Patch
- Implement strict admin credential policies and MFA
- Monitor /admin/tools/direct-install access and file uploads
🔍 How to Verify
Check if Vulnerable:
Check Grav version in admin dashboard or via CLI: php bin/grav versionCheck Version:
php bin/grav versionVerify Fix Applied:
Confirm version is v1.7.49+ and test admin plugin upload functionality📡 Detection & Monitoring
Log Indicators:
- POST requests to /admin/tools/direct-install
- Unusual plugin.zip uploads
- PHP execution from unexpected locations
Network Indicators:
- Outbound connections from web server to unknown IPs
- Unusual traffic patterns from admin interface
SIEM Query:
source="web_logs" AND uri="/admin/tools/direct-install" AND method="POST"