CVE-2026-72827 in Grav
Summary
by MITRE • 08/14/2026
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in Grav CMS prior to version 2.0.13 represents a critical server-side template injection flaw that fundamentally compromises the security posture of affected systems. This issue specifically targets the email action parameters within the CMS framework, creating an attack vector where low-privileged users with page editing capabilities can escalate their privileges and execute arbitrary operating system commands. The vulnerability arises from insufficient input sanitization and improper handling of user-supplied data within the email template processing pipeline, allowing malicious actors to inject dangerous payloads that bypass traditional security controls.
The technical exploitation of this vulnerability relies on the unsandboxed find filter functionality within Grav's Twig templating engine, which processes email subject, body, to, or from fields without adequate validation. When forms are submitted through the CMS interface, these unvalidated parameters flow directly into the template rendering process where they are interpreted as executable code rather than mere text. This creates a classic server-side template injection scenario where attackers can leverage Twig's powerful templating capabilities to construct malicious payloads that ultimately translate into operating system command execution on the server hosting the Grav CMS instance.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables full remote code execution capabilities for attackers who can manipulate form submissions. This allows threat actors to gain persistent access to the affected systems, potentially leading to data breaches, system compromise, and further lateral movement within network environments. The low privilege requirement for exploitation means that even users with minimal CMS permissions can leverage this vulnerability, making it particularly dangerous in multi-user environments where administrative controls may be insufficient. Organizations running vulnerable versions of Grav CMS face significant risk of unauthorized access and potential complete system compromise.
Mitigation strategies should prioritize immediate patching to Grav CMS version 2.0.13 or later, which addresses the template injection vulnerability through proper input validation and sanitization of email action parameters. Administrators should also implement network-level controls such as firewall rules that restrict direct access to form submission endpoints where possible, and consider implementing additional monitoring for unusual email processing patterns that might indicate exploitation attempts. The vulnerability aligns with CWE-94, which describes improper control of generation of code, and maps to ATT&CK technique T1059.007 for command and scripting interpreter usage, highlighting the need for both preventive measures and detection capabilities to address this critical security gap in web content management systems.