Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getgrav/grav

              develop @ 951cc43
            

178

Fixes

CVEs

CRITICAL

Peak severity

31.6%

Coverage

Highlights

Auth Bypass: 39 prior fixes. Scrutinize any change in this area.

system/src/Grav/Common/Utils.php: most-fixed (21 issues). Treat as high-risk during review.

107 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Server-Side Template Injection: Attackers repeatedly bypass SSTI filters by passing dangerous PHP functions as callbacks to Twig filters like |map and |filter. Functions like twig_array_map and twig_array_filter must restrict callbacks.

Path Traversal: Twig filesystem helper functions permit arbitrary local directory traversal and file reading. Safe path resolution must enforce canonical stream prefix boundaries and reject relative path sequences.

Arbitrary File Upload: Dangerous file uploads bypass protection mechanisms when extensions are not fully normalized to lowercase, or when the denylist fails to block page-content structures like .twig, .md, or server-executable types.