Executive brief
A security flaw in a popular Grav CMS plugin allows unauthorized individuals to remotely trigger scheduled tasks on a website. This plugin is typically used to automate maintenance tasks like backups or system updates. If an attacker triggers these tasks, they could potentially execute administrative commands, leading to a full takeover of the website or access to sensitive server data.
Technical details
An authentication bypass exists in the Grav CMS scheduler-webhook plugin due to a short-circuit logic flaw in `Scheduler::processWebhookTrigger()`. When the `webhookToken` is not explicitly configured (remaining `null`), the PHP comparison `if ($this->webhookToken && $token !== $this->webhookToken)` evaluates to false, skipping the authorization check entirely. A remote, unauthenticated attacker can exploit this by sending a POST request to the `/grav-admin/ajax.json/task:callWebhook` endpoint. This allows the attacker to execute all configured scheduled jobs, which often include shell commands for maintenance, potentially leading to remote code execution (RCE) under the context of the web server user. The vulnerability is patched in Grav CMS 2.0.9 and scheduler-webhook plugin 1.1.3.
Affected products
- Trilby Media Grav CMS scheduler-webhook plugin <= 1.1.3, <= 2.0.8
Timeline
- 2026-07-09: advisory: Initial GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date