Executive brief
The Grav Flex Objects plugin, a component used for managing complex data types in the Grav content management system, contains a security flaw in how it handles page titles. An attacker with the ability to edit page settings can inject malicious code that the server executes automatically. This could allow an attacker to steal sensitive data, modify website content, or take full control of the underlying web server.
Technical details
A stored server-side template injection (SSTI) vulnerability exists in the Grav Flex Objects plugin due to the unsafe use of Twig's 'template_from_string()' function. When rendering dynamic titles, the plugin processes user-controlled frontmatter values (specifically 'page.header.flex.collection.title' or 'page.header.flex.object.title') as Twig templates instead of literal text. This execution path bypasses the standard 'Security::cleanDangerousTwig()' sanitization mechanism. An authenticated attacker with low privileges (sufficient to modify page frontmatter) can achieve arbitrary Twig execution. This can be further escalated to remote code execution (RCE) by accessing the global 'grav' object and utilizing internal services like the scheduler to execute system commands. The issue is fixed in version 1.4.0.
Affected products
- getgrav Grav Flex Objects plugin < 1.4.0
Timeline
- 2026-06-22: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: NVD publication date