GetGrav up to 2.0.12 Email Action subject/body/to/from special elements used in a template engine

Summaryinfo

A vulnerability was found in GetGrav Grav up to 2.0.12 and classified as critical. Impacted is an unknown function of the component Email Action. The manipulation of the argument subject/body/to/from results in improper neutralization of special elements used in a template engine. This vulnerability was named CVE-2026-72827. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in GetGrav Grav up to 2.0.12. Affected is an unknown code of the component Email Action. The manipulation of the argument subject/body/to/from with an unknown input leads to a improper neutralization of special elements used in a template engine vulnerability. CWE is classifying the issue as CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-72827 since 08/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1221.

Upgrading to version 2.0.13 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• GetGrav

Name

• Grav

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12

Website

• Product: https://github.com/getgrav/grav/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion