high8.8
CVE-2026-109318
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting she…
Impact
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.
Affected products
| Product | Affected versions |
|---|---|
| Grav Git Sync 1.0.2 | through 3.4.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.