CVE-2026-109318: Grav Git Sync Command Injection Vulnerability

CVE-2026-109318 Overview

CVE-2026-109318 is a command injection vulnerability in the Grav Git Sync plugin, affecting versions 1.0.2 through 3.4.12. Authenticated content editors can inject shell substitutions into profile fields that reach PHP exec() through the git commit --author argument. When the gravuser or gravfull author mode is enabled, a malicious username, full name, or email runs operating system commands as the web-server account. The flaw is classified under CWE-78 (OS Command Injection) and enables full compromise of the Grav instance.

Critical Impact

Authenticated attackers with editor privileges can execute arbitrary OS commands as the web-server user, leading to full site takeover and lateral movement.

Affected Products

• Grav CMS with Git Sync plugin version 1.0.2
• Grav CMS with Git Sync plugin versions 2.x through 3.4.12
• Deployments with gravuser or gravfull author mode enabled

Discovery Timeline

• 2026-10-12 - CVE-2026-109318 published to the National Vulnerability Database
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109318

Vulnerability Analysis

The Grav Git Sync plugin automates version control of Grav content by committing changes to a Git repository. When committing, the plugin invokes git commit --author="<name> <email>" through PHP's exec() function. The plugin sources the author string from the editing user's profile fields when gravuser or gravfull mode is active.

Because the profile values are concatenated into the shell command without sanitization, an attacker can embed shell metacharacters such as backticks or $() substitutions. These substitutions are evaluated by the shell before git runs, giving the attacker arbitrary command execution under the web-server account.

Exploitation requires only an authenticated editor account. The attacker modifies a profile field, triggers any content action that invokes Git Sync, and the injected payload executes server-side. The resulting access permits webshell deployment, credential theft from Grav configuration files, and pivoting to connected Git remotes.

Root Cause

The plugin fails to validate or escape user-controlled profile data before passing it into a shell command. PHP's exec() executes the string through /bin/sh, which interprets ` and $() as command substitution. Author strings should be passed through escapeshellarg() or built using an argument array via proc_open() to prevent shell interpretation.

Attack Vector

An authenticated editor sets their profile username, full name, or email to a value such as attacker $(id > /tmp/pwn). On the next content save that triggers Git Sync, Grav assembles the commit author string and executes git commit --author=... through exec(). The shell evaluates the embedded command, writing attacker output to disk or opening a reverse shell. See the GitHub Security Advisory GHSA-c89w-55m3-fmf7 and the VulnCheck Command Injection Advisory for additional technical context.

Detection Methods for CVE-2026-109318

Indicators of Compromise

• Grav user profile fields containing shell metacharacters such as `, $(, ;, |, or &&
• Unexpected child processes of the web-server user (www-data, nginx, apache) spawned by php or git
• New or modified files under the Grav webroot that were not produced by content edits
• Outbound network connections from the web server to attacker-controlled infrastructure following a Git Sync commit

Detection Strategies

• Audit the Grav accounts/ YAML files for profile values containing shell metacharacters
• Review Git commit history for author strings containing substitution syntax or non-standard characters
• Correlate exec() calls from PHP processes with subsequent shell or network activity using endpoint telemetry
• Alert on git commit --author invocations whose author argument contains `, $, or ;

Monitoring Recommendations

• Enable process-execution auditing on the web server and forward events to a central log platform
• Monitor file integrity for the Grav user/, cache/, and tmp/ directories
• Track changes to Grav plugin and account configuration files
• Review Git Sync plugin logs for commit failures or unexpected execution paths

How to Mitigate CVE-2026-109318

Immediate Actions Required

• Upgrade the Grav Git Sync plugin to a version later than 3.4.12 that contains the author-sanitization fix
• Disable the gravuser and gravfull author modes until the plugin is patched
• Audit all editor accounts and reset any profile fields that contain shell metacharacters
• Rotate credentials and SSH keys stored on the Grav server if exploitation is suspected

Patch Information

Refer to the GitHub Security Advisory GHSA-c89w-55m3-fmf7 for the fixed release and remediation guidance from the Grav maintainers. Apply the upgrade across all Grav instances that use the Git Sync plugin.

Workarounds

• Switch the Git Sync author mode to a static, server-controlled author value instead of gravuser or gravfull
• Restrict editor account provisioning and require administrator approval for new editor roles
• Run the web-server process under a least-privileged account with no shell and no write access outside Grav directories
• Place the Grav admin interface behind network restrictions or a VPN to limit attacker reachability

# Configuration example: disable author modes that read user profile data
# In user/config/plugins/git-sync.yaml
git:
  author_mode: 'gitsync'   # avoid 'gravuser' and 'gravfull'
  name: 'grav-sync'
  email: 'sync@example.local'