Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109318Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

High 8.8

In plain English

A high-severity OS command injection in grav-plugin-git-sync from trilbymedia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.2%top 31.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.

Affected products (as reported)

Vendor	Product	Versions
trilbymedia	grav-plugin-git-sync	1.0.2 – before 3.4.13

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-c89w-55m3-fmf7) vendor-advisory, third-party-advisory
VulnCheck Advisory: Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author third-party-advisory