Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
Grav CMS may accept fake Referer from look‑alike domain
published 2 months ago
Summary
Grav CMS versions before 2.0.16 can be tricked into treating a web request as coming from the same site when the Referer header looks similar but actually belongs to a different domain (for example, https://example.com.attacker.tld). This happens because the software only checks that the Referer starts with the site's URL, without confirming the full address. Upgrade Grav to version 2.0.16 or later, or apply any available patches, to ensure proper origin verification.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Packagist | getgrav | getgrav/grav | All versions |
Original advisory text
Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9ccq-2jfg-qw33. This link is maintained to preserve external references.
### Original Description
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.
This advisory has been withdrawn because it is a duplicate of GHSA-9ccq-2jfg-qw33. This link is maintained to preserve external references.
### Original Description
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-346Origin Validation Error
Timeline
Published25 Aug 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
GHSA-qh7h-6c7g-x8m6 · OSV
Track software like this
Free during beta