Executive brief
Grav is a file-based content management system. A flaw in the Twig templating sandbox allows authenticated users with page-editing permissions to execute arbitrary PHP code on the server by bypassing security checks in the sort filter. An attacker with minimal privileges can craft a malicious page that executes commands with the web server's privileges.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the sortFunc wrapper of GravExtension.php. The filter incorrectly hardcodes the isSandboxed flag to false when calling Twig's CoreExtension::sort(), bypassing the Closure-only enforcement that protects other filters (map, filter, reduce). This allows an attacker to pass a plain function name instead of a Closure. The denylist of dangerous functions misses spl_autoload, which performs a PHP include. An authenticated user with admin.pages or api.pages.write permissions can craft page frontmatter (e.g., via the Email plugin) containing a sort filter that calls spl_autoload with a path, achieving arbitrary PHP execution as the web user. No authentication bypass is required; only page-edit rights are needed. Fixed in version 2.0.19.
Affected products
- Getgrav Grav <= 2.0.17
Timeline
- 2026-08-20: disclosed
- 2026-09-04: advisory
- 2026-09-04: patched: Fixed in version 2.0.19