CVE-2026-75829 in Grav
Summary
by MITRE • 08/18/2026
grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Grav Plugin API versions prior to 1.0.15 represents a critical server-side template injection flaw rooted in insufficient input validation within the translate endpoint. This security defect allows authenticated users possessing api.pages.write permissions to inject malicious Twig code into page content and headers. The core technical failure lies in the application's inability to sanitize or escape user-supplied data before it is processed by the Twig templating engine. When an attacker submits crafted parameters, specifically targeting the header and content fields of a new or existing page, these inputs are stored directly within the system without adequate filtering mechanisms. Consequently, when the affected pages are rendered for display, the embedded template expressions are interpreted and executed by the server rather than being treated as static text. This behavior transforms what appears to be standard content management functionality into a vector for arbitrary code execution on the backend infrastructure.
The operational impact of this vulnerability is severe due to its potential for remote code execution with elevated privileges. Since Twig is capable of accessing PHP functions and system resources, successful exploitation can lead to complete compromise of the underlying server environment. An attacker could potentially read sensitive configuration files, exfiltrate database credentials stored in plain text within templates or config files, execute arbitrary shell commands via specific Twig extensions, or pivot further into the internal network depending on the hosting architecture. The requirement for api.pages.write permission means that any user account with this level of access can be leveraged to trigger the vulnerability. This is particularly dangerous in multi-tenant environments or applications where lower-level contributors are granted write permissions but should not have administrative capabilities, as it allows privilege escalation through code injection rather than traditional authentication bypass techniques.
From a classification perspective, this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically focusing on server-side template injection. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as the attacker utilizes the Twig interpreter to execute commands within the application's context. The vulnerability exploits the trust relationship between the content management system and its templating engine, assuming that all input is safe until proven otherwise. This assumption fails when dynamic evaluation of user-controlled data occurs without proper sandboxing or escaping. The lack of validation in the translate endpoint serves as a direct entry point for these malicious payloads, bypassing any higher-level security controls that might exist elsewhere in the application logic.
Mitigation strategies must prioritize immediate patching and strict input sanitization practices. Administrators running Grav Plugin API versions earlier than 1.0.15 should upgrade to version 1.0.15 or later immediately to resolve this issue, as the vendor has implemented necessary validation checks to prevent Twig code execution from user inputs. In scenarios where upgrading is not feasible in the short term, implementing a Web Application Firewall with rules specifically designed to detect and block common template injection patterns such as double curly braces {{ }} can provide temporary protection. Additionally, enforcing strict least-privilege access controls ensures that only trusted administrators possess api.pages.write permissions, thereby reducing the attack surface available to potential adversaries. Regular security audits of custom plugins and third-party extensions are also recommended to identify similar vulnerabilities in other endpoints that may handle dynamic content rendering.