Vulnerability Description
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm
- https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-t
- https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm
FAQ
What is CVE-2026-72827?
CVE-2026-72827 is a vulnerability with a CVSS score of 8.8 (HIGH). Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attack...
How severe is CVE-2026-72827?
CVE-2026-72827 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-72827?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.