GHSA-gwfr-jfjf-92vv Grav has Insecure Deserialization in File Cache

• Packagist getgrav/grav: < 2.0.0-beta.2 → fixed in 2.0.0-beta.2

Insecure Deserialization in File Cache • Severity: High • CWE: CWE-502 • Location: `system/src/Grav/Framework/Cache/Adapter/FileCache.php` • Sink: `unserialize($value, ['allowed_classes' => true])` Affected version(s) • Affected: `>= 1.7.44` and ` true` allows object instantiation and does not constrain classes. PoC (Primitive Demonstration) Preconditions • Local PHP runtime. • Goal is to validate the deserialization primitive used in cache retrieval. Steps ```bash php -r ' class CacheWakeup { public function __wakeup(){ file_put_contents("/tmp/grav_filecache_poc.txt", "wakeup"); } } $payload = serialize(new CacheWakeup()); unserialize($payload, ["allowed_classes" => true]); echo file_exists("/tmp/grav_filecache_poc.txt") ? "FILECACHE_UNSERIALIZE_TRIGGERED\n" : "FILECACHE_UNSERIALIZE_NOT_TRIGGERED\n"; ' ``` Expected Result • Output contains: `FILECACHE_UNSERIALIZE_TRIGGERED`. Interpretation This reproduces the same unsafe primitive used by `FileCache::doGet()`: `unserialize($value, ['allowed_classes' => true])`. If cache files are attacker-tampered, object magic methods may execute. Exploit Preconditions • Cache file poisoning/tampering capability. Recommendation • Avoid object deserialization in cache payloads. • Use non-object formats and integrity protection for cache files. --- Maintainer note — fix applied (2026-04-24) Fixed in Grav core on the `2.0` branch: commit `c66dfeb5f` — will ship in 2.0.0-beta.2. What changed: `Framework\Cache\Adapter\FileCache` now HMAC-signs every cache payload with `Security::getNonceKey()` on write, and verifies the HMAC on read. Tampered, forged, or pre-upgrade files are treated as cache misses and unlinked instead of being unserialized. The on-disk format is now versioned: ``` v2 ``` Existing caches rebuild transparently on first read. Note that `Framework\Cache\Adapter\FileCache` isn't wired into Grav's main cache path — Symfony's `FilesystemAdapter` is — but the class is reachable by plugin and downstream consumers, so the hardening applies defensively. Files: • `system/src/Grav/Framework/Cache/Adapter/FileCache.php`. • `tests/unit/Grav/Common/Security/FileCacheSecurityTest.php` — round-trip, tampered-payload rejection, wrong-key forgery rejection, pre-v2 file rebuild, key-field mismatch.