CVE-2026-75829CWE-1336

CVE-2026-75829

High · published August 18, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2026-08-18T16:19Z
References (2)
https://github.com/getgrav/grav/security/advisories/GHSA-w94c-jmg4-w4c9 · [email protected]https://www.vulncheck.com/advisories/grav-plugin-api-before-twig-ssti-via-translate-endpoint · [email protected]
EPSS history
Timeline
  • 18 AUG 11:19Z
    grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint
    cvelistv5