Grav API Plugin CVE-2026-72824

Three specific conditions must be simultaneously present for exploitation to succeed. First, the attacker must hold a valid API key explicitly scoped to api.pages.write that was minted against a super-admin Grav account - API keys associated with non-super-admin accounts are not affected because isSuperAdmin() returns false for those accounts, and the scope bypass never triggers. Second, the Grav site must be configured with security.twig_content.process_enabled=true, a non-default setting that enables the Twig templating engine to process expressions embedded in page content; sites that have not enabled this setting cannot reach the RCE execution path. Third, editor_enabled must be set to false in the API plugin configuration. What limits exploitation in practice: the attacker cannot self-issue an API key without prior authenticated access to a super-admin Grav account; the required non-default Twig configuration (process_enabled=true) substantially narrows the exposed population to sites that have deliberately enabled that feature; and the scope bypass specifically requires the key to have been issued on a super-admin account, not merely any authenticated account.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects accurate network accessibility and low-privilege exploitation once a qualifying API key is in hand, though the AT:N designation merits scrutiny: the attack realistically requires two non-default configuration settings (process_enabled=true and editor_enabled=false), which in CVSS 4.0 language would more precisely be AT:P. The EPSS of 0.47% at the 38th percentile is low and likely reflects Grav's moderate deployment footprint combined with the key-holding prerequisite that limits opportunistic mass scanning. However, SSVC's classification of exploitation as automatable with total technical impact substantially overrides the EPSS signal for targeted risk decisions - any attacker who already holds a scoped API key faces no additional barriers to achieving full RCE. No CISA KEV listing is present in the input, so confirmed in-the-wild exploitation is unverified. The combination of a public POC, full-CIA impact, and automated exploitability means this warrants urgent remediation regardless of the low EPSS percentile, particularly for organizations running Grav with the described non-default Twig configuration.

An attacker who has been issued or has otherwise obtained a Grav API key scoped to api.pages.write on a super-admin account sends a crafted HTTP POST to the pages API endpoint, embedding a Twig SSTI payload (such as a reverse-shell template invoking PHP's system() or exec()) in the page content body, targeting a site where security.twig_content.process_enabled=true and editor_enabled=false. The guardTwigContent() function passes the isSuperAdmin() gate because the key's parent account holds super-admin status, and the Twig engine processes the payload server-side, granting the attacker code execution as the web server process user. A public proof-of-concept exists per SSVC intelligence, meaning this attack path is documented and reproducible without advanced capability.