CVE-2026-72827

CVE-2026-72827CVE-2026-72827

Description

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

Scoring

CVSS 8.8 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Last modified2026-08-14
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.