Grav CMS before 2.0.13 Remote Code Execution via Twig

Advisories

Grav CMS before 2.0.13 Remote Code Execution via Twig

severity: high
date: 8/14/2026
Affecting: grav >= 0, < 2.0.13
CVE: CVE-2026-72827
CWE: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-xx48-97m4-h7qm)
Credit: Kuba0123
Description: Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo