CVE-2026-109318 in Grav Git Sync Plugin
Summary
by MITRE • 10/12/2026
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Grav Git Sync plugin versions 1.0.2 through 3.4.12 are susceptible to a critical command injection vulnerability that stems from improper sanitization of user-supplied input within profile fields. This flaw specifically affects authenticated content editors who possess the ability to modify their own account details, such as username, full name, or email address. The security failure occurs because these input fields are directly passed into system commands without adequate validation or escaping mechanisms. When an attacker crafts a malicious payload containing shell metacharacters and submits it through these profile settings, the application fails to neutralize the special characters before passing them to the operating system interface.
The technical mechanism of exploitation relies on the plugin's integration with Git for version control synchronization. Specifically, when the gravuser or gravfull author mode is enabled within the Grav CMS configuration, the plugin utilizes the git commit command and passes user-provided data into its --author parameter. This parameter accepts a string formatted as Name <email>, which is then executed via PHP exec() functions on the server side. Because shell substitutions are not stripped from the input fields like username or full name, an attacker can inject commands that get interpreted by the underlying shell during the execution of the git commit operation. For instance, appending command separators such as semicolons or pipes to a crafted author string allows arbitrary code execution within the context of the process invoking the plugin.
The operational impact of this vulnerability is severe due to its potential for remote code execution under specific conditions. Since the commands are executed by the web-server account, typically running with limited privileges but still possessing access to the application's files and database, an attacker can compromise the integrity and confidentiality of the website data. Successful exploitation allows threat actors to read sensitive configuration files, modify content, or potentially escalate privileges if additional vulnerabilities exist within the server environment. This represents a significant risk for organizations relying on Grav CMS with Git Sync enabled, as it undermines the trust model that requires only authenticated users to have access while assuming they cannot execute arbitrary system commands through legitimate administrative features.
From an industry standards perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-94 Improper Control of Generation of Code. In the context of the MITRE ATT&CK framework, this behavior is consistent with techniques involving command and script interpretation where attackers leverage legitimate system utilities to execute malicious payloads. The vulnerability highlights a common pitfall in web application development where user input intended for display or metadata purposes is inadvertently reused as executable code without proper sanitization checks.
To mitigate this risk, administrators should immediately update the Grav Git Sync plugin to version 3.4.13 or later, which addresses these input validation flaws by properly escaping special characters before they are passed to system commands. If updating is not immediately feasible, it is advisable to disable the gravuser and gravfull author modes if they are currently enabled, thereby preventing the direct injection of user data into git commit arguments. Additionally, implementing strict output encoding and validating all inputs against a whitelist of allowed characters can provide defense-in-depth measures. Regular security audits focusing on how user-supplied data interacts with system-level functions are essential to prevent similar command injection vulnerabilities in other plugins or core components of the Grav CMS ecosystem.