CVE-2024-27921
HighPublic exploitGrav File Upload Path Traversal
Published Mar 22, 2024 · Updated Oct 16, 2026 · Also known as GHSA-m7hx-hw6h-mqmc
Key Facts
Patch immediately- CVE-2024-27921 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Grav (Getgrav), getgrav/grav (composer).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 61% probability of exploitation in the next 30 days.
- Fixed versions are available, including Grav 1.7.45, getgrav/grav 1.7.45.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
61%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2024-27921 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GravGetgrav | >= < 1.7.45 | 1.7.45 |
| getgrav/gravcomposer | See advisory | 1.7.45 |
Patched Releases
Grav
1.7.45
getgrav/grav
1.7.45
Timeline
Publicly disclosed
Mar 22, 2024
Last updated
Oct 16, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27921.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2024-27921
- patchhttps://github.com/getgrav/grav/commit/5928411b86bab05afca2b33db4e7386a44858e99
- exploithttps://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc
FAQ
Common Questions.
Grav is an open-source, flat-file content management system.
Affected: Grav (Getgrav) versions >= < 1.7.45; getgrav/grav (composer). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Grav 1.7.45, getgrav/grav 1.7.45.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-27921 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo