CVE-2026-58655
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
The Grav Flex Objects plugin before version 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, user-controlled frontmatter values are passed to Twig's template_from_string(), causing them to be evaluated as Twig code rather than text. This bypasses Grav's Security::cleanDangerousTwig() sanitization.
Risk Assessment
An attacker who can control the title frontmatter of a publicly accessible Flex Objects page can achieve arbitrary Twig execution and escalate to remote command execution via access to internal Grav services such as the scheduler. This could lead to full server compromise.
Recommendation
Immediately update the Grav Flex Objects plugin to version 1.4.0 or later. If an update is not possible, restrict access to Flex Objects pages to trusted users only and verify that no malicious values have already been injected.
Other vulnerabilities in Grav Flex Objects plugin
See all- CVE-2026-114659Medium
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions without enforcing api.pages.read/write or page-level permission rules. Authenticated non-super users can read page source and frontmatter, modify content, or delete pages they are denied.
- CVE-2026-62670Medium
The Grav Flex Objects plugin prior to 1.4.3 has requireFlexPermission() that returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object authorization fallback would deny the same actions.
Original NVD description (English source)
The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(), causing them to be evaluated as Twig code rather than treated as text. This path bypasses Grav's Security::cleanDangerousTwig() sanitization. An attacker who can control the title frontmatter of a publicly reachable Flex Objects page can achieve arbitrary Twig execution and escalate to remote command execution via access to internal Grav services such as the scheduler.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS