Grav CMS EUVD-2026-40452

The OS command-injection path requires authenticated administrator access to the plugin/theme installation feature and exploits unescaped branch, url, and path parameters passed into the git clone shell command - admin privilege is the explicit limiting factor. The PHP object-injection paths require that the attacker controls the serialized input reaching one of three specific unserialize() sinks (Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, or Session) AND that a usable gadget chain exists in the loaded class set; reachability of these sinks by an unauthenticated remote attacker is not detailed in the source data and should be validated per deployment. The Twig SSTI path requires the ability to inject template expressions that traverse the bypassed security blocklist. Limiting factors across vectors: admin authentication for command injection, attacker control over serialized bytes for deserialization, and template-input access for SSTI - meaning the published PR:N (unauthenticated) rating applies only to the most favorable vector, not all three.

The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) represents the worst-case blended rating across the three flaw classes and implies remote, unauthenticated, full-impact code execution, but the individual vectors differ in real prerequisites and that nuance matters for prioritization. The command-injection path explicitly requires admin access (PR would realistically be High for that vector alone), and the deserialization paths require that an attacker actually controls the serialized bytes fed to unserialize() - feasible for Session/FileCache only where that data is influenceable, and a working public gadget chain is not documented in the provided data. EPSS and SSVC data were not supplied, and the vulnerability is not in CISA KEV, so there is no signal of active or automatable mass exploitation. Net assessment: a genuinely serious, patch-now bug for internet-facing Grav installs given RCE potential and a reputable reporter (VulnCheck), but the PR:N rating likely reflects the deserialization vector's best case rather than uniform unauthenticated reachability - verify which path is exploitable in your deployment. Conflict to note: the assigned CWE-78 covers only the command-injection issue, while the highest-severity behavior is object-injection deserialization (CWE-502), so the single CWE understates the bug's true breadth.

An attacker who can place or influence serialized data consumed by Grav's Session or FileCache supplies a crafted PHP object payload; when Grav calls unserialize() without class restrictions, a magic-method gadget chain executes and yields arbitrary PHP code on the server. Alternatively, a malicious or compromised administrator installs a plugin/theme whose branch, url, or path field contains shell metacharacters, causing the unescaped git clone command to execute attacker-chosen OS commands. No public exploit or gadget chain is documented in the available data, so weaponization effort is presently unverified.