Grav CMS CVE-2026-72827

Exploitation requires a valid Grav CMS page editor account - the minimum authenticated role capable of configuring or submitting forms with email-action parameters. The target installation must be running a Grav CMS version prior to 2.0.13, and at least one form must have email-action configured with parameters (subject, body, to, or from) that are rendered through the unsandboxed Twig find filter. Exploitation is triggered at form submission, meaning the attacker must be able to submit the affected form. What limits exploitation: unauthenticated users cannot exploit this directly; the attack surface is bounded by the presence of email-action-enabled forms; and sites where all editor accounts are tightly controlled by administrators face substantially reduced realistic risk. No special network position, non-default server configuration, or additional tooling is required beyond the authenticated session.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) characterizes this as network-reachable with low attack complexity, requiring only low-privileged access and no user interaction - consistent with any authenticated page editor. High impact across VC/VI/VA confirms full system compromise potential. No EPSS score was supplied, preventing probabilistic exploitation likelihood assessment; this gap should be noted by defenders. The CVE is not listed in CISA KEV and no POC has been confirmed, meaning active exploitation is not verified. However, SSTI via Twig is a well-catalogued attack class with widely published technique libraries, substantially lowering the bar for a motivated attacker once the affected endpoint is identified. The PR:L requirement is the primary real-world limiting factor: exploitation is constrained to authenticated page editors, meaning sites with tightly controlled or trusted-only editor roles face materially lower risk than those permitting broad or self-service editor registration.

A threat actor with a valid Grav page editor account navigates to a form configured with email-action and injects a Twig payload such as {{ ['id'] | map('system') | join }} into the email subject or body field. Upon form submission, the unsandboxed find filter evaluates the expression server-side, executing the OS command with the privileges of the web server process. From this foothold, the attacker can enumerate the server, exfiltrate files, establish persistence, or pivot to adjacent systems.