{"action":"Upgrade getgrav/grav to 1.7.11 or later.","affected":[{"fixed":"1.7.11","introduced":"0"}],"component":"getgrav/grav","cve_ids":["CVE-2021-29440"],"ecosystem":"Packagist","epss":0.29896,"exploited":false,"fixed_versions":["1.7.11"],"ghsa_id":"GHSA-g8r4-p96j-xfxc","id":"tcs_01M5KF2GSZD2ZTP2P84YSTYBBM","modified_at":"2026-05-04T08:45:55.155955489Z","published_at":"2021-04-16T19:53:12Z","references":["https://osv.dev/vulnerability/GHSA-g8r4-p96j-xfxc","https://github.com/getgrav/grav/security/advisories/GHSA-g8r4-p96j-xfxc","https://nvd.nist.gov/vuln/detail/CVE-2021-29440","https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities","https://packagist.org/packages/getgrav/grav","http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.html"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"GHSA-g8r4-p96j-xfxc","url":"https://osv.dev/vulnerability/GHSA-g8r4-p96j-xfxc"}],"summary":"Grav's Twig processing allowing dangerous PHP functions by default"}