Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-75574Grav before 4.2.2 Remote Code Execution via Email Twig
High 8.8
In plain English
A high-severity security flaw in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.
Affected products (as reported)
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-gh8j-q67c-j53f) vendor-advisory
- VulnCheck Advisory: Grav before 4.2.2 Remote Code Execution via Email Twig third-party-advisory