Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the Languages submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or an XSS test string—it causes a fatal regular expression parsing error on the server. This leads to application-wide failure due to the use of the preg_match() function with an improperly constructed regular expression, resulting in an error. Once triggered, the site becomes completely unavailable to all users. This vulnerability is fixed in 1.8.0-beta.27.
An exception is thrown from a function, but it is not caught.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Grav | Getgrav | 1.7.48 (including) | 1.8.0 (excluding) |
| Grav | Getgrav | 1.8.0-beta1 (including) | 1.8.0-beta1 (including) |
| Grav | Getgrav | 1.8.0-beta10 (including) | 1.8.0-beta10 (including) |
| Grav | Getgrav | 1.8.0-beta11 (including) | 1.8.0-beta11 (including) |
| Grav | Getgrav | 1.8.0-beta12 (including) | 1.8.0-beta12 (including) |
| Grav | Getgrav | 1.8.0-beta13 (including) | 1.8.0-beta13 (including) |
| Grav | Getgrav | 1.8.0-beta14 (including) | 1.8.0-beta14 (including) |
| Grav | Getgrav | 1.8.0-beta15 (including) | 1.8.0-beta15 (including) |
| Grav | Getgrav | 1.8.0-beta16 (including) | 1.8.0-beta16 (including) |
| Grav | Getgrav | 1.8.0-beta17 (including) | 1.8.0-beta17 (including) |
| Grav | Getgrav | 1.8.0-beta18 (including) | 1.8.0-beta18 (including) |
| Grav | Getgrav | 1.8.0-beta19 (including) | 1.8.0-beta19 (including) |
| Grav | Getgrav | 1.8.0-beta2 (including) | 1.8.0-beta2 (including) |
| Grav | Getgrav | 1.8.0-beta20 (including) | 1.8.0-beta20 (including) |
| Grav | Getgrav | 1.8.0-beta21 (including) | 1.8.0-beta21 (including) |
| Grav | Getgrav | 1.8.0-beta22 (including) | 1.8.0-beta22 (including) |
| Grav | Getgrav | 1.8.0-beta23 (including) | 1.8.0-beta23 (including) |
| Grav | Getgrav | 1.8.0-beta24 (including) | 1.8.0-beta24 (including) |
| Grav | Getgrav | 1.8.0-beta25 (including) | 1.8.0-beta25 (including) |
| Grav | Getgrav | 1.8.0-beta26 (including) | 1.8.0-beta26 (including) |
| Grav | Getgrav | 1.8.0-beta3 (including) | 1.8.0-beta3 (including) |
| Grav | Getgrav | 1.8.0-beta4 (including) | 1.8.0-beta4 (including) |
| Grav | Getgrav | 1.8.0-beta5 (including) | 1.8.0-beta5 (including) |
| Grav | Getgrav | 1.8.0-beta6 (including) | 1.8.0-beta6 (including) |
| Grav | Getgrav | 1.8.0-beta7 (including) | 1.8.0-beta7 (including) |
| Grav | Getgrav | 1.8.0-beta8 (including) | 1.8.0-beta8 (including) |
| Grav | Getgrav | 1.8.0-beta9 (including) | 1.8.0-beta9 (including) |