Grav Plugin Git Sync
Monthly
Authenticated content editors on Grav CMS sites running the Git Sync plugin versions 1.0.2 through 3.4.12 can execute arbitrary OS commands as the web-server account when the plugin's gravuser or gravfull author mode is enabled, by planting shell substitution payloads in their username, full name, or email profile fields that are later interpolated into a git commit --author call and reach PHP exec(). The vulnerability is rated 8.7 (CVSS 4.0) and maps to CWE-78; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires authenticated, low-privileged editor access but no victim interaction, with the additional gating condition that author mode must be explicitly turned on and must not be left at its default posture. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is a credible, prioritizable bug rather than a drop-everything emergency - though any site with untrusted or broadly provisioned editor accounts and author mode enabled should treat it as an immediate command-execution risk.
Authenticated content editors on Grav CMS sites running the Git Sync plugin versions 1.0.2 through 3.4.12 can execute arbitrary OS commands as the web-server account when the plugin's gravuser or gravfull author mode is enabled, by planting shell substitution payloads in their username, full name, or email profile fields that are later interpolated into a git commit --author call and reach PHP exec(). The vulnerability is rated 8.7 (CVSS 4.0) and maps to CWE-78; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires authenticated, low-privileged editor access but no victim interaction, with the additional gating condition that author mode must be explicitly turned on and must not be left at its default posture. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is a credible, prioritizable bug rather than a drop-everything emergency - though any site with untrusted or broadly provisioned editor accounts and author mode enabled should treat it as an immediate command-execution risk.