CVE-2026-72698

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation. An authenticated user can upload a ZIP file containing PHP code, bypass name validation using array notation, and write PHP files to the web root for execution.

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives. Blueprint::isSafeDynamicCall() only applies its denylist to strings without '::'. An account with page-editing rights (admin.pages) can plant a directive that invokes an arbitrary public static PHP method with attacker-controlled arguments. This allows reading any server-readable file and arbitrary creation/copying of files and directories.

Grav CMS before version 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session deserialize untrusted data without class restrictions, enabling PHP object injection and, via a gadget chain, arbitrary code execution. Additionally, InstallCommand's git clone operation does not escape branch, url, and path parameters, allowing OS command injection during plugin/theme installation (requires admin access). A Twig security blocklist bypass (server-side template injection) is also present.

Grav is a flat-file content management system. In versions prior to 1.7.42, there was a server-side template injection vulnerability that allowed remote code execution by not blocking certain built-in functions exposed by Twig.

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection, allowing remote code execution by a user with page editing privileges.

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with) with no trailing delimiter. An attacker controlling a domain that begins with the victim site's origin (e.g., https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.

Grav CMS before version 2.0.16 has a timing vulnerability in Utils::verifyNonce() that uses non-constant-time comparison (===) instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonces byte-by-byte.

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process can write to, and the next scheduled job run will follow the symlink and overwrite the target file's content with the job ID string.