EUVD-2026-58638
GHSA-qpvv-mv8x-vg3c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the two non-default configuration requirements (process_enabled=true, editor_enabled=false) outside attacker control; PR:L for the required API key credential.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pages_twig is intentionally outside the api.pages scope. When security.twig_content.process_enabled=true and editor_enabled=false, this allows Twig-in-content to execute server-side, resulting in server-side template injection (SSTI) and remote code execution.
AnalysisAI
Server-side template injection (SSTI) leading to remote code execution in the Grav CMS API plugin (getgrav/grav-plugin-api) before version 1.0.13 is reachable by any low-privilege API key holder whose key was minted on a super-admin account. The root flaw is in PagesController::guardTwigContent(), which gates Twig processing via a bare isSuperAdmin() call that ignores the api_key_scopes array, allowing a key deliberately scoped to api.pages.write to enable process.twig on page save despite admin.pages_twig being intentionally excluded from that scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must be simultaneously present for exploitation to succeed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects accurate network accessibility and low-privilege exploitation once a qualifying API key is in hand, though the AT:N designation merits scrutiny: the attack realistically requires two non-default configuration settings (process_enabled=true and editor_enabled=false), which in CVSS 4.0 language would more precisely be AT:P. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has been issued or has otherwise obtained a Grav API key scoped to api.pages.write on a super-admin account sends a crafted HTTP POST to the pages API endpoint, embedding a Twig SSTI payload (such as a reverse-shell template invoking PHP's system() or exec()) in the page content body, targeting a site where security.twig_content.process_enabled=true and editor_enabled=false. The guardTwigContent() function passes the isSuperAdmin() gate because the key's parent account holds super-admin status, and the Twig engine processes the payload server-side, granting the attacker code execution as the web server process user. … |
| Remediation | The primary fix is to upgrade the Grav API plugin to version 1.0.13 or later, which corrects PagesController::guardTwigContent() to evaluate api_key_scopes rather than relying solely on isSuperAdmin(); the vendor advisory is at https://github.com/getgrav/grav/security/advisories/GHSA-96xv-p87j-58mx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all API keys created with super-admin account privileges and review recent API activity logs for unauthorized page modifications or template execution attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or e
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today