high8.8
CVE-2026-72827
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute ar…
Impact
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.
Affected products
| Product | Affected versions |
|---|---|
| Grav CMS | before 2.0.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.