GHSA-vj3m-2g9h-vm4p: Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with composer audit.
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Multiple RCE vectors were found in Grav CMS. Three are critical, two are high.

1. Unsafe unserialize() in JobQueue — direct RCE gadget (Critical)

system/src/Grav/Common/Scheduler/JobQueue.php:465 calls unserialize(base64decode(...)) without restricting allowedclasses. The Job class has calluserfuncarray($this->command, $this->args) in its execution path, which is a direct gadget chain — inject a serialized Job with command = 'system' and args = ['whoami'].

The same codebase actually has a Serializable trait that correctly restricts classes, so this inconsistency stands out.

2. Unsafe unserialize() in FileCache — arbitrary class instantiation (Critical)

system/src/Grav/Framework/Cache/Adapter/FileCache.php:75 does unserialize($value, ['allowedclasses' => true]). That true allows instantiation of any class. If an attacker can write to the cache directory (via any file write primitive), they get object injection → RCE.

3. Unsafe unserialize() in Session (High)

system/src/Grav/Common/Session.php:116 — same allowedclasses => true pattern on session data. Lower severity since session storage is typically more restricted.

Sources and references

1. GitHub Advisory GHSA-vj3m-2g9h-vm4p github.com
2. github.com github.com
3. github.com github.com

Critical Composer (PHP) advisories · Today’s Security Digest