Which versions of Grav Flex Objects are affected by CVE-2026-58655?

Grav's Flex Objects plugin contains a stored template injection vulnerability affecting versions before 1.4.0 that allows low-privileged content authors to execute arbitrary code on affected web…. A patch is available.

How to fix or mitigate CVE-2026-58655?

Within 24 hours, audit all Grav installations for Flex Objects plugin usage and identify affected versions, then disable the plugin on non-critical systems and restrict content author permissions to trusted users only. Within 7 days, establish a testing environment to validate upgrade procedures and compatibility for the patched version when available, while implementing WAF rules to block suspicious Twig template patterns in title parameters. Within 30 days, deploy the patched Flex Objects plugin version to all production systems once vendor patch becomes available, applying comprehensive testing before rollout and validating that no active exploitation occurred.

Grav Flex Objects CVE-2026-58655

Q: What is the CVSS score of CVE-2026-58655?

CVE-2026-58655 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-44633 HIGH

Code Injection (CWE-94)

2026-07-15 VulnCheck

GHSA-mpq7-q5x9-rf83

RCE Code Injection Grav Getgrav

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable stored injection needing only a low-privileged authoring account (PR:L) and no user interaction, yielding full RCE with high C/I/A; scope unchanged as code runs within the Grav app context.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:27 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

HIGH 8.7

DescriptionCVE.org

The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(), causing them to be evaluated as Twig code rather than treated as text. This path bypasses Grav's Security::cleanDangerousTwig() sanitization. An attacker who can control the title frontmatter of a publicly reachable Flex Objects page can achieve arbitrary Twig execution and escalate to remote command execution via access to internal Grav services such as the scheduler.

AnalysisAI

Stored server-side template injection in Grav's bundled Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 lets a low-privileged content author inject Twig code through the dynamic collection/object title frontmatter, which is passed unsanitized to template_from_string() and executed. Because the title path bypasses Grav's Security::cleanDangerousTwig() filter, an attacker can reach internal Grav services such as the scheduler and escalate arbitrary Twig evaluation to full remote command execution. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Grav is a PHP flat-file CMS that uses the Twig templating engine for page rendering. The Flex Objects plugin supports dynamic collection and object titles defined in a page's frontmatter (page.header.flex.collection.title / page.header.flex.object.title). Rather than emitting these values as literal text, the plugin feeds them into Twig's template_from_string() function, which compiles and evaluates the supplied string as a live Twig template - the classic root cause of CWE-94 (Improper Control of Generation of Code / code injection) when the string is attacker-controlled. Grav normally defends against template abuse with Security::cleanDangerousTwig(), which strips dangerous Twig constructs from user content, but this title-rendering code path is invoked outside that sanitization boundary, so the filter never runs. The affected component is Grav itself as shipped with the bundled plugin; the CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* identifies the Grav application as the vulnerable product family.

RemediationAI

Vendor-released patch: upgrade the Grav Flex Objects plugin to version 1.4.0 or later, which is the primary and recommended fix; apply it via the Grav plugin manager (bin/gpm update flex-objects) or by updating the bundled plugin in your Grav install, and review the advisory at https://github.com/getgrav/grav/security/advisories/GHSA-623v-m3c4-3pw8. Where immediate patching is not possible, reduce exposure by restricting which accounts can create or edit Flex Objects page frontmatter - remove page-authoring/admin rights from semi-trusted users so no attacker can set the collection or object title fields (trade-off: constrains legitimate editorial workflows) - and audit existing Flex Objects pages for suspicious title frontmatter containing Twig syntax ({{, {%, template_from_string). Additionally, run the Grav process under a least-privileged OS account and restrict or disable access to the internal scheduler service to blunt the RCE escalation path, accepting that disabling the scheduler will stop scheduled Grav tasks from running. See VulnCheck's advisory at https://www.vulncheck.com/advisories/grav-flex-objects-server-side-template-injection-via-dynamic-titles for details.