CVE-2025-50286

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

13.64% chance of exploitation in the next 30 days, 96th percentile

Published

2025-08-06

Updated

2025-08-07

Proof-of-concept exploits (3)

• binneko/CVE-2025-502862★ · 2025-08-05
• x1o3/CVE-2025-502860★ · 2026-04-09
• hn7494213-glitch/CVE-projecttt0★ · 2025-11-27

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grav_admin_direct_ins…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52402

References

• CVE Record
• NVD entry

Related

• CVE-2025-46041
• CVE-2023-50011