CVE-2021-21425

CVE-2021-21425 is a critical vulnerability affecting Grav Admin Plugin versions 1.10.7 and earlier, allowing an unauthenticated attacker to execute administrator controller methods. This enables arbitrary YAML file creation or modification, leading to configuration changes, potential administrator account hijacking, or operating system command execution under the web server's context. With a CVSS score of 9.8 (Critical) and an EPSS score of 0.91639, the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, leading to high impact on confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, exploit modules are available in Metasploit and ExploitDB, indicating a high potential for exploitation, despite limited community discussion or media coverage.