Grav API Plugin CVE-2026-72825

Exploitation requires a valid API key bearing api.config.write scope that was explicitly minted on a super-admin account - a key issued to a non-super account is insufficient because isSuperAdmin() will return false. The POST /reports/twig-content/allowlist endpoint must be network-reachable (no firewall blocking the API port). Converting the allowlist write into RCE requires a second step: a Twig render of attacker-controlled or attacker-influenced content must occur after the allowlist is widened, either via direct content editing access or by inducing another user to trigger a render. Exploitation is bounded by: the requirement for a super-admin-minted api.config.write API key (non-default, requires administrative issuance); the two-step nature of the attack (allowlist write then render); and the absence of a confirmed public exploit or automated scanner at time of analysis.

The reported CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L) captures only the immediate allowlist-write impact and understates the realistic risk ceiling: successful allowlist widening converts all subsequent Twig renders on the instance into SSTI/RCE sinks, which should elevate confidentiality and availability impacts substantially. PR:L is accurate and represents the primary risk-limiting factor - exploitation requires a valid api.config.write-scoped API key that was specifically minted on a super-admin account, a non-default and non-trivial prerequisite that meaningfully narrows the exploitable population. EPSS data was not provided, preventing quantitative exploitation probability assessment. No CISA KEV listing and no confirmed public POC reduce immediate urgency, though the attack primitive (allowlist poisoning → SSTI → RCE) requires no novel techniques. Defenders should treat any externally accessible Grav API instance running the plugin below 1.0.13 where super-admin API keys with config.write scope exist as at material risk of full server compromise through the two-step chain.

An attacker who possesses or has socially engineered a least-privilege api.config.write API key issued on a super-admin Grav account sends a crafted POST /reports/twig-content/allowlist request, appending a permissive Twig tag (such as an unrestricted PHP filter) to the sandbox allowlist persisted in user/config/security.yaml. In a subsequent step - either by editing Grav content directly or by inducing a content editor to render attacker-influenced material - the attacker embeds a Twig SSTI payload exploiting the newly permitted tag, achieving arbitrary PHP execution on the server. No public POC has been confirmed at time of analysis, though the allowlist-widen-then-SSTI chain is well-documented in Grav CMS security research.