CVE-2026-75574 | BDVDB-2026-364421 Detail

Description#

The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-25Record published in the CVE List.
2. Version 22026-08-27Most recent update recorded in the CVE List.