Vulnerability · Published Jul 15, 2026 · Assigned by VulnCheck

CVE-2026-58655Grav Flex Objects - Server-Side Template Injection via Dynamic Titles

High 8.8

In plain English

A high-severity code injection in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.4%top 27.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(), causing them to be evaluated as Twig code rather than treated as text. This path bypasses Grav's Security::cleanDangerousTwig() sanitization. An attacker who can control the title frontmatter of a publicly reachable Flex Objects page can achieve arbitrary Twig execution and escalate to remote command execution via access to internal Grav services such as the scheduler.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 1.4.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-623v-m3c4-3pw8) vendor-advisory
VulnCheck Advisory: Grav Flex Objects - Server-Side Template Injection via Dynamic Titles third-party-advisory