THREAT OPS › Threat News › [GHSA] GHSA-9ccq-2jfg-qw33 (low) — Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
[GHSA] GHSA-9ccq-2jfg-qw33 (low) — Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
GHSA-9ccq-2jfg-qw33 Severity: low CVE: CVE-2026-72702
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
## Summary
`Grav\Common\Uri::referrer()` and `Grav\Common\Page\Pages::referrerRoute()` both check whether an incoming request's `Referer` header "came from our site" using `str_starts_with($referrer, $base)`, where `$base` is the site's o
Indicators of compromise
- c2b46866857a93a0aa7048e7ed707ed3ed45dbc3sha1
- CVE-2026-72702cve
- https://example.com`url
- https://example.com.attacker.tld`url
- https://example.com\n\nurl
- https://attacker.tld/phishurl
- https://example.com.attacker.tld/phishurl
- https://example.com-attacker.tld/phishurl
- https://example.com-attacker.tld`url
- https://TARGETHOST.attacker.tld/xurl
- https://TARGETHOST/some/routeurl
- packagist.orgdomain
Original source: https://github.com/advisories/GHSA-9ccq-2jfg-qw33