Description

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T12:16:45.907Z",
  "pubdate": "2026-08-14T12:16:45.907Z",
  "executiveSummary": "Grav CMS before version 2.0.13 contains a severe server-side template injection vulnerability residing within email-action parameters. The flaw allows authenticated, low-privileged page editors to execute arbitrary operating-system commands on the underlying host. The vulnerability stems from improper handling of user-supplied input within email-action parameters, specifically through the unsandboxed find filter utilized in email subject, body, to, or from fields. Successful exploitation requires low-privileged user access and form submission interaction. The business and operational impact is critical, as a successful attack grants the attacker remote code execution capabilities, potentially leading to total system compromise, unauthorized data access, and lateral movement within the network infrastructure.",
  "technicalDetails": "The vulnerability is classified as a server-side template injection flaw affecting Grav CMS prior to version 2.0.13. The root cause lies in the application's email-action handling mechanisms, where user-supplied input destined for email configuration fields is improperly processed by the Twig templating engine. Specifically, the application evaluates input fields—namely email subject, body, to, and from parameters—using an unsandboxed find filter. Authentication and low-privileged page editor privileges are required to interact with the vulnerable form parameters.\nThe attack flow proceeds as follows: First, an attacker with low-privileged page editor access navigates to the form configuration or email-action parameters within Grav CMS. Second, the attacker crafts a malicious payload incorporating Twig template syntax leveraging the unsandboxed find filter. Third, the attacker injects this payload into one or more of the vulnerable email-related fields such as the subject, body, recipient, or sender parameters. Fourth, upon the submission or processing of the form, the application passes the untrusted input directly into the unsandboxed Twig evaluation context without adequate sanitization or sandboxing.\nBecause the template evaluation environment lacks proper restriction and utilizes insecure filtering mechanisms, the injected Twig payload is executed by the server engine. This evaluation breaks out of the intended template context and allows the execution of arbitrary operating-system commands with the privileges of the web server process. The post-exploitation impact includes full remote code execution, persistence establishment, exfiltration of sensitive application data, and potential compromise of the underlying host operating system."
}