CVE-2026-72827

8.7 highEPSS 0.9%

High (8.7). EPSS 0.9% chance of exploitation in the next 30 days.

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-11-01)
CWE: CWE-1336
Published: 2026-08-14
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm
https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-twig
https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm

Check your stack JSON