CVE-2022-2073: 
PHP vulnerability analysis and mitigation

Code Injection vulnerability (CVE-2022-2073) was discovered in GitHub repository getgrav/grav prior to version 1.7.34. The vulnerability was related to the Twig |filter() function allowing code execution (CVE Details, MITRE).

The vulnerability was found in the Twig template engine's |filter() function implementation within the Grav CMS. The issue allowed for potential code execution through unsafe filtering operations. A fix was implemented in commit 9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83, which added security checks to prevent dangerous function execution through the filter (GitHub Commit).

The vulnerability could allow attackers to execute arbitrary code through the Twig template engine's filter function, potentially compromising the security of the affected Grav CMS installations (Huntr).

The vulnerability was fixed in Grav version 1.7.34. The fix includes implementing additional security checks in the Twig filter function to prevent execution of dangerous functions. Users should upgrade to version 1.7.34 or later to mitigate this vulnerability (GitHub Commit).