Grav Git Sync EUVD-2026-97620

Requires the Git Sync plugin's 'gravuser' or 'gravfull' author mode to be explicitly enabled - not the default posture - and an authenticated account with content-editor privileges able to modify profile fields (username, full name, or email). The limiting factors are therefore twofold: valid authenticated access (PR:L) and the specific author-mode configuration; sites running Git Sync without author mode enabled, or without editor accounts exposed to untrusted users, are not exploitable. No user interaction by a victim is required once the attacker has editor access.

This is a credible, prioritizable vulnerability but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full High impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - consistent with CWE-78 OS command injection yielding code execution as the web-server account. The PR:L metric aligns with the description's requirement for an authenticated content editor, so this is authenticated, not a pre-auth internet-wide threat. Exploitation status is 'no public exploit identified at time of analysis': the input provides no KEV listing and no POC flag, so there is no evidence of active exploitation or published exploit code. No EPSS score was supplied, so exploitation probability cannot be quantified from the data. There is one important conditional constraint the raw CVSS does not capture: exploitation only works when the 'gravuser' or 'gravfull' author mode is enabled - a non-default-dependent configuration that materially narrows the real exploitable population. Net: treat as a high-severity, patch-promptly issue for organizations running the Git Sync plugin in author-mode configurations, but the authentication requirement and config dependency reduce real-world urgency relative to the 8.7 headline score.

An attacker who holds (or phishes/obtains) a low-privilege Grav content-editor account on a site running Git Sync in gravuser/gravfull author mode edits their profile and embeds a shell substitution (e.g. $(...) or backticks) into the username, full name, or email field. When the plugin builds a 'git commit --author' call and passes it to PHP exec(), the injected command runs as the web-server user, giving the attacker arbitrary OS command execution on the host. No public exploit code is identified at time of analysis, but the attack path is straightforward and low-complexity.