Skip to main content

Grav CMS CVE-2026-72827

| EUVDEUVD-2026-58641 HIGH
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
2026-08-14 VulnCheck GHSA-4jrc-qc5x-3wrr
Ssti RCE Grav
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-reachable form submission, low complexity; PR:L for required editor account; S:C because OS-level command execution breaks out of the CMS application boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 14, 2026 - 13:01 EUVD
Analysis Generated
Aug 14, 2026 - 12:28 vuln.today
CVE Published
Aug 14, 2026 - 11:35 cve.org
HIGH 8.7

DescriptionCVE.org

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

AnalysisAI

Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed find filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privileged page editor
Delivery
Locate form with email-action parameters
Exploit
Inject Twig payload into subject, body, to, or from field
Execution
Submit form to trigger server-side Twig evaluation
Persist
Unsandboxed find filter executes OS command
Impact
Arbitrary code runs as web server process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid Grav CMS page editor account - the minimum authenticated role capable of configuring or submitting forms with email-action parameters. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) characterizes this as network-reachable with low attack complexity, requiring only low-privileged access and no user interaction - consistent with any authenticated page editor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A threat actor with a valid Grav page editor account navigates to a form configured with email-action and injects a Twig payload such as `{{ ['id'] | map('system') | join }}` into the email subject or body field. Upon form submission, the unsandboxed `find` filter evaluates the expression server-side, executing the OS command with the privileges of the web server process. …
Remediation Upgrade to Grav CMS 2.0.13 or later, the vendor-released patch confirmed by GitHub Security Advisory GHSA-xx48-97m4-h7qm (https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Grav CMS installations and document current versions; immediately audit and restrict page editor account assignments to only essential, fully-trusted personnel, and enable comprehensive logging of all page editor activities for forensic review. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ssti

View all
CVE-2024-23692 CRITICAL POC
9.8 May 31

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
CVE-2025-47916 CRITICAL POC
10.0 May 16

Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
CVE-2024-6386 CRITICAL POC
9.9 Aug 21

Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
CVE-2025-23211 CRITICAL POC
9.9 Jan 28

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
CVE-2024-32651 CRITICAL POC
10.0 Apr 26

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
CVE-2024-4040 CRITICAL POC
10.0 Apr 22

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
CVE-2026-15734 CRITICAL POC
9.8 Aug 06

Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
CVE-2024-24724 CRITICAL POC
9.8 Apr 03

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
CVE-2026-28496 CRITICAL POC
9.4 Jun 23

Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
CVE-2025-1040 HIGH POC
8.8 Mar 20

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
CVE-2026-69118 HIGH POC
8.7 Aug 10

Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directive
CVE-2023-6709 HIGH POC
8.8 Dec 12

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all
CVE-2024-23692 CRITICAL POC
9.8
CVE-2025-47916 CRITICAL POC
10.0
CVE-2025-49619 HIGH POC
8.5
CVE-2024-6386 CRITICAL POC
9.9
CVE-2025-69516 HIGH POC
8.8
CVE-2025-49136 CRITICAL POC
9.0
CVE-2025-53833 CRITICAL POC
10.0
CVE-2025-23211 CRITICAL POC
9.9

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2026-72827 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy