CVE-2026-72827
HighCVSS 8.8Summary
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.
Risk Assessment
Remote code execution can lead to full server compromise, data confidentiality breach, modification or deletion, and further attacks using the server.
Recommendation
Upgrade Grav CMS to version 2.0.13 or later, which includes the fix, and restrict page editor permissions to the minimum necessary.
Original NVD description (English source)
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.