CVE-2026-72827CWE-1336

CVE-2026-72827

High · published August 14, 2026

CVSS v3.1

8.8

EPSS

Percentile

57.8

In the wild

Unconfirmed

What it is

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00850 · 57.8th percentile
Weakness: CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published: 2026-08-14T16:16Z

References (3)

https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm · [email protected]https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-twig · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

14 AUG 11:35Z
Grav CMS before 2.0.13 Remote Code Execution via Twig
cvelistv5