Grav CMS CVE-2026-85604

Exploitation requires an authenticated session with the admin.pages or api.pages.write permission on the target Grav instance-these are the roles assigned to content editors who can create or modify pages. The attacker must control content that is subsequently rendered by Grav's Twig engine; the advisory identifies form frontmatter processed by the Email plugin as a confirmed delivery path, but any Twig rendering surface accepting user-supplied |sort callables is potentially exploitable. No elevated network position (e.g., LAN adjacency) is required-only HTTPS access to the Grav admin or API endpoint. Exploitation is bounded by the authentication requirement: unauthenticated attackers cannot trigger the flaw directly. The minimum foothold is a valid low-privilege page-write account, which constrains the realistic threat population to insiders, compromised credentials, or attackers who have already achieved authenticated access through another vector.

The CVSS 4.0 vector supplied in the input (PR:N/UI:N/VC:H/VI:N/VA:N) materially misrepresents the exploitation requirements: the description is unambiguous that a valid authenticated account with page-write permissions (admin.pages or api.pages.write) is mandatory, and the impact is full RCE-not confidentiality-only. This vector should not be used for prioritization decisions. The real-world risk remains substantial: page-write roles are routinely granted to content contributors and site editors, meaning the attacker population includes any insider or individual who has obtained low-privilege credentials. The pivot from content-editor to shell access is a severe privilege escalation. No public exploit code has been identified, and the vulnerability is absent from CISA KEV, which moderates immediate urgency; however, the GitHub security advisory GHSA-p6qj-p5m7-f62h provides sufficient technical detail that a working exploit could be developed with modest effort, and even a mid-sized municipal IT team in sanok running a multi-editor Grav deployment should treat patching as urgent rather than deferring to compensating controls. EPSS data was not provided, preventing quantitative exploitation-probability assessment.

An attacker authenticates to Grav with a content-editor account (admin.pages permission), then creates or modifies a page whose form frontmatter contains a crafted Twig template that invokes the |sort filter with spl_autoload as the sort callback. When the Email plugin (or another Twig rendering path) processes the page, spl_autoload is called with an attacker-controlled class name, causing PHP to include an attacker-accessible file on the server and execute its contents as the web server user. No public exploit code has been identified, but the advisory's technical specificity makes this scenario straightforward to implement.