CVE-2026-75829
HighCVSS 8.1Summary
The grav-plugin-api plugin before version 1.0.15 fails to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.
Risk Assessment
The risk involves remote code execution on the server, potentially leading to full server compromise and data breach.
Recommendation
Immediately update the grav-plugin-api plugin to version 1.0.15 or later and restrict api.pages.write permissions to trusted users only.
Original NVD description (English source)
grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.