Grav Flex Objects CVE-2026-58655

Exploitation requires the attacker to control the dynamic title frontmatter of a Flex Objects page - specifically the page.header.flex.collection.title or page.header.flex.object.title values - on a Grav install running the bundled Flex Objects plugin before version 1.4.0, and the affected page must be publicly reachable so the title is rendered. The limiting factor is that setting this frontmatter requires low-privileged authenticated access to page authoring/editing (CVSS PR:L), so purely anonymous unauthenticated exploitation is not indicated by the data; there is no user-interaction requirement (UI:N) once the payload is planted, and no non-default feature toggle is described - dynamic titles are a normal Flex Objects capability. Exploitation is further bounded to deployments still on a vulnerable pre-1.4.0 plugin build.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) describes a network-reachable, low-complexity attack that requires low privileges, no user interaction, and yields high impact to confidentiality, integrity, and availability of the vulnerable system, with no scope change (SC:N) - consistent with authenticated RCE on the Grav host. The PR:L requirement is the key limiter: the attacker must already be able to author or edit the title frontmatter of a Flex Objects page, i.e. hold a content-editor-level account or otherwise control page frontmatter, which meaningfully narrows the population of real attackers versus a pre-auth flaw. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; the CVE is not in CISA KEV and no proof-of-concept is referenced, so there is no evidence of active or public exploitation. Net assessment: a genuinely serious authenticated-RCE priority for any Grav deployment that grants page-authoring rights to semi-trusted or numerous users, but the low-privilege prerequisite makes indiscriminate mass exploitation less likely than the high base score alone might suggest.

A user with content-authoring access to a Grav site edits or creates a publicly reachable Flex Objects page and sets its dynamic title frontmatter (e.g. page.header.flex.object.title) to a malicious Twig payload. When any visitor loads the page, Grav compiles the title through template_from_string(), executing the attacker's Twig, which reaches internal services such as the scheduler to run operating-system commands as the web application user. No public proof-of-concept is referenced in the available data, and the network/low-complexity vector means the payload triggers reliably on normal page rendering once planted.