Description

Grav before 2.0.19 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes spl_autoload through the sort filter, resulting in arbitrary PHP execution as the web server user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T12:17:24.177Z",
  "pubdate": "2026-09-04T12:17:24.177Z",
  "executiveSummary": "Grav versions 2.0.17 and earlier contain a critical remote code execution (RCE) vulnerability within the Twig templating engine's sort filter.\nThe vulnerability originates from an improper implementation of Twig's sandboxing mechanism in GravExtension.php, where the sort filter incorrectly allows the execution of arbitrary PHP functions.\nAn authenticated user possessing page-write permissions (admin.pages or api.pages.write) can leverage this flaw to trigger unauthorized code execution.\nBy supplying a crafted payload—such as via form frontmatter processed by the Email plugin—an attacker can invoke the spl_autoload function.\nBecause spl_autoload executes as the web server user, this vulnerability enables full server-side command execution, leading to total compromise of the application environment.\nThe risk is severe as it allows authenticated low-privileged users to escalate privileges to full system control, bypassing standard Twig security constraints.",
  "technicalDetails": "The vulnerability resides within the custom Twig extension logic defined in GravExtension.php. Specifically, the sortFunc wrapper implementation incorrectly sets Twig's isSandboxed argument to false when interacting with the |sort filter. Unlike other filtering mechanisms such as |map, |filter, or |reduce, which maintain strict sandbox integrity, the |sort filter inadvertently permits the execution of plain function names that should otherwise be restricted.\nThe root cause is a deficiency in the internal denylist used to restrict function calls within the Twig sandbox. While the system attempts to restrict dangerous operations, it fails to include spl_autoload in the denylist. The spl_autoload function acts as a wrapper that performs a PHP include operation, which is inherently dangerous when user-supplied input is passed to it.\nExploitation is achieved by an authenticated attacker who can manipulate content rendered by the Twig engine, such as through page frontmatter or plugins like the Email plugin that process user-controlled inputs. By passing a specifically crafted payload to the |sort filter, the attacker forces the application to execute spl_autoload with malicious arguments.\nThe attack flow follows a sequential pattern: 1) The attacker authenticates as a user with page-write capabilities. 2) The attacker injects a malicious payload into a field processed by the Twig engine. 3) The Twig engine processes the |sort filter, invoking the vulnerable sortFunc wrapper. 4) Due to the lack of sandboxing and the missing denylist entry for spl_autoload, the PHP interpreter executes the arbitrary code embedded in the payload. 5) The payload leverages spl_autoload to include and execute arbitrary PHP files or instructions on the server.\nThe post-exploitation impact allows the attacker to execute arbitrary system commands, read sensitive configuration files, modify application data, or establish persistent backdoors, all under the privileges of the web server process. This bypasses the intended limitations of the Grav administrative interface, allowing for complete system takeover by an actor with minimal legitimate administrative access."
}