high8.1Public exploit code
CVE-2025-50286
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Grav CMS 1.7.48 - Remote Code Execution (RCE)2025-08-11 · webapps · php
Impact
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getgrav | Grav | Version 1.7.48 |