Grav Email Plugin CVE-2026-75574

Exploitation requires an authenticated session with both api.access and api.pages.write permissions - these are content-editor-level roles, not administrator roles, meaning the privilege bar is intentionally low for many Grav multi-user deployments. The attacker must be able to create or modify a Grav page that includes an Email form action, specifically controlling the header.form.process.email.body parameter in the page frontmatter. The Grav Email plugin must be installed and active on the target instance. The associated form must be submittable - either publicly accessible or submittable by the attacker themselves - to trigger rendering. Exploitation is bounded to Grav Email plugin versions prior to 4.2.2; single-user or admin-only deployments are not realistically at risk from external attackers, though insider threat remains valid. The OS-level impact radius is constrained by the privilege level of the PHP process user.

The CVSS 4.0 score of 8.7 reflects a network-accessible, low-complexity attack with no user interaction required, yielding high confidentiality, integrity, and availability impact on the vulnerable system. The most operationally significant signal is the low privilege threshold: api.access and api.pages.write are content-editor-level permissions routinely granted to non-administrative contributors, dramatically widening the realistic attacker pool beyond admin-only vulnerabilities. SSTI in Twig is a thoroughly documented attack class - exploitation patterns are publicly catalogued and require only moderate attacker skill even absent a specific POC for this CVE. No CISA KEV listing and no confirmed active exploitation reduce urgency somewhat, and the EPSS signal is absent from provided data, so probabilistic exploitation rate cannot be independently assessed. Scope impact (SC:N/SI:N/SA:N in the 4.0 vector) is listed as contained to the vulnerable system, though OS command execution as the PHP process user may reach adjacent resources depending on deployment context - organizations should verify the PHP process user's privilege level and filesystem/network reach. Overall, this should be treated as urgent for any publicly reachable Grav installation with multi-user content editing enabled.

A malicious content editor with api.access and api.pages.write permissions creates a new Grav page and sets header.form.process.email.body to a Twig payload such as {{ ['id'] | map('system') | join }}, then publishes the page. Upon form submission - which the attacker can trigger themselves or socially engineer - the Email plugin renders the body field as an unsandboxed Twig template, executing the OS command as the PHP process user. No public POC has been identified at time of analysis, but standard Twig SSTI exploitation techniques are well-documented and widely available.