EUVD-2026-40452
GHSA-58cg-x8gx-6hg3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but the dominant credible paths need attacker-controlled serialized input plus a gadget chain (AC:H) or authenticated access (PR:L); successful exploitation yields full RCE, so C/I/A High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Grav CMS before 2.0.0-beta.2 stems from three distinct flaw classes: PHP object injection via unsafe unserialize() of attacker-controllable data in the Scheduler JobQueue, FileCache adapter, and Session components, an OS command injection in the plugin/theme InstallCommand git clone routine, and a Twig sandbox blocklist bypass enabling server-side template injection. An attacker who can influence the serialized input can chain available gadgets to run arbitrary PHP, while the command-injection path is reachable by authenticated administrators through plugin/theme installation. No public exploit identified at time of analysis; the issues were privately reported by VulnCheck and are fixed in 2.0.0-beta.2.
Technical ContextAI
Grav is a PHP-based flat-file CMS that uses no database, relying on filesystem caches, sessions, and YAML/Twig for templating. The core weakness in the deserialization vector is CWE-502-style PHP Object Injection: unserialize() is called on untrusted data without an allowed_classes allowlist in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session, so a magic-method (__wakeup/__destruct) gadget chain present in Grav's dependency tree can be triggered to reach code execution. The CWE assigned (CWE-78, OS Command Injection) maps to the InstallCommand path, where the branch, url, and path parameters of a git clone are concatenated into a shell command without escapeshellarg-style escaping, letting shell metacharacters break out into arbitrary OS commands. The third issue is server-side template injection through a bypass of Grav's Twig security blocklist, which is meant to sandbox user-supplied template expressions. The CPE cpe:2.3:a:grav:grav:*:*:*:*:*:*:*:* confirms the Grav application itself (all versions prior to the fix) is the affected product.
RemediationAI
Upgrade to the fixed release - Vendor-released patch: 2.0.0-beta.2 - which addresses all three flaw classes; this is the primary and recommended remediation, documented in the vendor advisory GHSA-vj3m-2g9h-vm4p (https://github.com/getgrav/grav/security/advisories/GHSA-vj3m-2g9h-vm4p). Because the fixed version is a beta, organizations on stable channels should review release notes and test before deploying, and if immediate upgrade is not possible apply compensating controls per vector: restrict and audit administrator accounts and avoid installing untrusted plugins/themes to blunt the InstallCommand OS command injection (trade-off: limits legitimate admin self-service installs); place the admin panel and any session/cache-writing endpoints behind a VPN, IP allowlist, or reverse-proxy authentication to reduce who can influence serialized data (trade-off: hampers remote administration); and disable or tightly review any feature allowing user-supplied Twig templates to mitigate the SSTI blocklist bypass (trade-off: breaks templates that legitimately accept dynamic expressions). Ensure session and cache storage directories are not writable by untrusted users and rotate session secrets after patching. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/grav-multiple-remote-code-execution-vulnerabilities-via-unsafe-unserialize-and-command-injection) for vector-specific detail.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today