# CVE-2026-109318: Grav Git Sync command injection via commit author

Source: https://junglewise.ai/threats/cve-2026-109318-grav-git-sync-1-0-2-through-3-4-12-contains-a-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109318 · Severity: high · CVSS 8.8 · Published 2026-10-12

Grav Git Sync is a plugin that automates synchronization of website content changes to a Git repository by creating commits with author information. Authenticated content editors can inject shell commands into their user profile fields (username, full name, or email), which get executed with web-server privileges when changes are committed. An attacker can run arbitrary OS commands on the server, potentially leading to data breach, malware installation, or server compromise.

Vendors: [Getgrav](https://junglewise.ai/threats/vendors/getgrav).

## Quick answers

**Is CVE-2026-109318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109318 being exploited in the wild.

**How severe is CVE-2026-109318?** High severity, with a CVSS score of 8.8, published 12 October 2026.

**Which products and versions are affected?** Getgrav Grav Git Sync 1.0.2 through 3.4.12.

**Is there a fix for CVE-2026-109318?** Yes: fixed in Git Sync 3.4.13. Until then: Disable Git Sync synchronization on save or configure it to use the default gituser author mode, which does not expose user profile fields to this attack vector. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109318 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109318?** Check whether you run Getgrav Grav Git Sync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Git Sync 3.4.13

Disable Git Sync synchronization on save or configure it to use the default gituser author mode, which does not expose user profile fields to this attack vector.

## Technical details

The vulnerability exists in GitSync::commit() when author mode is set to gravuser or gravfull, which builds Git commands as shell strings using the active user's profile data without proper escaping. The --author argument is constructed with unescaped double quotes that fail to neutralize shell substitutions, allowing command injection. The unsanitized command reaches PHP exec() during automatic synchronization when content is saved, and since Grav Admin allows users to edit their own profiles, authenticated content editors can control the malicious payload.

## Affected products

- getgrav Grav Git Sync 1.0.2 through 3.4.12

## Timeline

- 2026-09-23: disclosed: GitHub Security Advisory GHSA-c89w-55m3-fmf7 published
- 2026-10-12: advisory: CVE-2026-109318 assigned

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-c89w-55m3-fmf7](https://github.com/getgrav/grav/security/advisories/GHSA-c89w-55m3-fmf7)
- [https://www.vulncheck.com/advisories/grav-git-sync-1.0.2-through-3.4.12-command-injection-via-commit-author](https://www.vulncheck.com/advisories/grav-git-sync-1.0.2-through-3.4.12-command-injection-via-commit-author)