CVE-2020-11529: 
PHP vulnerability analysis and mitigation

Common/Grav.php in Grav before version 1.7 contained an Open Redirect vulnerability (CVE-2020-11529). This security issue was partially addressed in version 1.6.23 but remained present in the 1.6.x branch. The vulnerability affected the core functionality of the Grav content management system (CVE Details).

The vulnerability was related to path-based open redirect functionality in the system. When Grav was installed in the root folder of a domain with trailing slash redirect enabled, it was possible to exploit this vulnerability. The issue manifested when specially crafted URLs containing encoded characters were processed, such as '%252f%255c' sequences, which could lead to unintended redirects (GitHub Issue).

When successfully exploited, the vulnerability allowed attackers to perform open redirects, potentially leading users to malicious websites. This could be particularly problematic when Grav was installed in the root folder of a domain, as demonstrated by example URLs that could redirect to arbitrary destinations (GitHub Issue).

The issue was addressed through a security patch that implemented proper route cleaning for redirects. The fix included adding a regular expression pattern to clean potentially malicious redirect paths. The complete fix was implemented in version 1.7, with a partial fix in version 1.6.23 (GitHub Commit).