CVE-2026-56700: Grav CMS RCE Vulnerability

CVE-2026-56700 Overview

CVE-2026-56700 affects Grav CMS versions prior to 2.0.0-beta.2. The advisory documents multiple code-execution flaws in the flat-file content management system. Three unsafe unserialize() calls in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session deserialize untrusted data without restricting allowed classes. Attackers who control serialized input can trigger PHP object injection and reach arbitrary code execution through gadget chains. A separate OS command injection exists in InstallCommand, where git clone receives unescaped branch, url, and path parameters during plugin or theme installation. A Twig security blocklist bypass also permits server-side template injection.

Critical Impact
Unauthenticated attackers who can influence serialized inputs can execute arbitrary PHP code on the server hosting Grav CMS.

Affected Products

Grav CMS versions prior to 2.0.0-beta.2
Grav CMS plugin and theme installation subsystem (InstallCommand)
Grav CMS Twig rendering pipeline (blocklist bypass)

Discovery Timeline

2026-06-30 - CVE-2026-56700 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56700

Vulnerability Analysis

CVE-2026-56700 bundles four distinct issues in Grav CMS. The first three are insecure deserialization defects. Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session all invoke unserialize() on data an attacker can influence, and none of them supply an allowed_classes option. PHP therefore instantiates arbitrary classes, which enables object injection and gadget-chain execution.

The fourth issue is an OS command injection in the InstallCommand used to install plugins and themes. The command passes user-supplied branch, url, and path values into a shell string used to invoke git clone. Because the values are not escaped, an authenticated administrator can inject shell metacharacters.

A Twig security blocklist bypass rounds out the advisory, permitting server-side template injection against filters that were expected to be blocked. The upstream fix is delivered in 2.0.0-beta.2.

Root Cause

The deserialization flaws stem from calling unserialize() on attacker-controlled bytes without an allow-list of classes [CWE-502]. The command injection stems from string concatenation of untrusted parameters into a shell command instead of using an argument array with proper escaping [CWE-78]. The Twig issue stems from an incomplete blocklist rather than a positive allow-list of safe primitives.

Attack Vector

The deserialization sinks are reachable over the network wherever Grav accepts session cookies, cache entries, or scheduler queue data derived from user input. A crafted serialized payload triggers a PHP object injection that pivots to remote code execution via a gadget chain. The InstallCommand vector requires administrator access and is exploited by supplying shell metacharacters in the plugin or theme installation parameters. The Twig bypass is exploited wherever untrusted input reaches template rendering.

See the GitHub Security Advisory and the VulnCheck Advisory on Grav RCE for the affected sinks and reproduction details.

Detection Methods for CVE-2026-56700

Indicators of Compromise

Unexpected serialized PHP objects (strings beginning with O: or a:) inside session files, cache files under cache/, or scheduler queue storage.
New or modified PHP files under the user/ or cache/ directories that do not correspond to legitimate content updates.
git child processes spawned by the Grav PHP process with unusual arguments containing shell metacharacters such as ;, |, `, or $(.
Outbound network connections initiated by the PHP-FPM or web server user shortly after plugin or theme installation activity.

Detection Strategies

Inspect Grav session and cache stores for serialized payloads referencing unexpected class names, especially framework or vendor classes with magic methods.
Monitor process trees for the web server or PHP-FPM user spawning git, sh, bash, or php with attacker-controlled arguments.
Alert on writes to Grav plugin, theme, or user/config/ directories that occur outside change-management windows.
Review admin panel access logs for plugin or theme installation requests originating from unexpected accounts or source IPs.

Monitoring Recommendations

Enable PHP error and access logging with full request bodies at the reverse proxy so serialized payloads are retained for forensic review.
Baseline the set of processes spawned by the Grav process and alert on deviations.
Track file integrity across system/, vendor/, and installed plugins to catch web-shell drops after exploitation.

How to Mitigate CVE-2026-56700

Immediate Actions Required

Upgrade Grav CMS to 2.0.0-beta.2 or later on all production and staging instances.
Rotate administrator credentials and any API tokens used by the admin plugin after upgrading.
Invalidate existing sessions and clear the Grav cache and scheduler queue to remove any attacker-planted serialized data.
Audit installed plugins and themes for unauthorized additions or modifications introduced through InstallCommand.

Patch Information

The maintainers fixed all four issues in Grav CMS 2.0.0-beta.2. The fix restricts allowed classes on the three unserialize() call sites, escapes arguments passed to git clone in InstallCommand, and tightens the Twig security policy. Refer to the GitHub Security Advisory for the authoritative patch details.

Workarounds

Restrict admin panel access to trusted source IPs using web server or firewall rules until the upgrade is complete.
Disable plugin and theme installation via the admin UI to neutralize the InstallCommand command injection path.
Place a web application firewall rule in front of Grav to block requests whose cookies or bodies contain PHP-serialized object markers (O: followed by a class name).
Isolate the Grav process with a restricted OS user, mandatory access control, and outbound egress filtering to limit post-exploitation impact.

bash

# Example: upgrade Grav and clear cached/serialized state after patching
php bin/gpm selfupgrade -f
php bin/grav clear-cache --all
rm -f user/data/scheduler/jobs.yaml.queue
find cache/ -type f -name '*.cache' -delete