{"id":"CVE-2020-29553","aliases":["GHSA-fqff-vcvx-68h3"],"url":"https://o3.security/vulnerability/CVE-2020-29553","summary":"Grav CMS Cross-Site Request Forgery (CSRF)","details":"The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).","published":"2021-03-15T19:15:13.243Z","modified":"2026-08-07T11:30:59.454489705Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"getgrav/grav","fixedVersion":null},{"ecosystem":"Packagist","name":"getgrav/grav","fixedVersion":"1.6.30"}],"fix":null,"references":[{"type":"EVIDENCE","url":"https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:30:59.454489705Z"}}