CVE-2026-58655: Grav Flex Objects Plugin RCE Vulnerability

CVE-2026-58655 Overview

CVE-2026-58655 is a stored server-side template injection (SSTI) vulnerability in the Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) prior to version 1.4.0. The plugin renders dynamic collection and object titles by passing user-controlled frontmatter values to Twig's template_from_string() function. This causes attacker-supplied strings to be evaluated as Twig code instead of static text. The rendering path bypasses Grav's Security::cleanDangerousTwig() sanitization routine. An attacker who controls the title frontmatter of a publicly reachable Flex Objects page can achieve arbitrary Twig execution and pivot to remote command execution through internal Grav services such as the scheduler. The weakness is tracked under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
Authenticated attackers with page authoring privileges can achieve remote command execution on the underlying Grav CMS host through Twig template injection.

Affected Products

Grav CMS bundling the getgrav/grav-plugin-flex-objects plugin
Grav Flex Objects plugin versions prior to 1.4.0
Grav installations exposing Flex Objects pages publicly

Discovery Timeline

2026-07-15 - CVE-2026-58655 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-58655

Vulnerability Analysis

The Flex Objects plugin supports dynamic titles for collections and individual objects. When Grav renders a Flex Objects page, the plugin reads the page.header.flex.collection.title or page.header.flex.object.title frontmatter fields and passes them directly to Twig's template_from_string(). Twig treats the argument as an inline template and compiles it. Any expression enclosed in {{ ... }} or {% ... %} is evaluated within the Twig sandbox context available to the request.

The Grav core exposes Security::cleanDangerousTwig() to strip known-dangerous Twig constructs from user input before rendering. The Flex Objects code path invokes template_from_string() without routing values through that filter. As a result, payloads that would normally be stripped, such as filter chains reaching PHP callables or accesses to the grav global service container, execute unmodified.

Once arbitrary Twig executes, an attacker can reach internal Grav services. The advisory specifically names the scheduler service, which permits registration and execution of shell commands. Chaining the Twig primitive with scheduler access converts template evaluation into full remote command execution as the web server user.

Root Cause

The root cause is unsafe use of template_from_string() on frontmatter fields that a low-privilege author can influence. The plugin trusts frontmatter as static text and skips the central sanitization layer that Grav applies elsewhere.

Attack Vector

An attacker with permission to create or edit a Flex Objects page sets a malicious Twig expression as the collection or object title. When any visitor requests the page, the server compiles the title as Twig and executes the embedded expression. The attack requires network access to the Grav site and low-privilege authenticated access to author a page. See the GitHub Security Advisory GHSA-623v-m3c4-3pw8 and the VulnCheck Advisory on Grav for technical details on the vulnerable rendering path.

Detection Methods for CVE-2026-58655

Indicators of Compromise

Frontmatter fields flex.collection.title or flex.object.title containing Twig delimiters such as {{, {%, or references to grav., scheduler, or system().
Unexpected entries or shell commands added to the Grav scheduler configuration under user/config/scheduler.yaml.
Web server processes (php-fpm, apache2) spawning shell interpreters (sh, bash) or network utilities (curl, wget, nc) shortly after HTTP requests to Flex Objects pages.
Modifications to .md page files under user/pages/ containing Twig syntax in title fields.

Detection Strategies

Grep the Grav content tree for frontmatter titles containing Twig control sequences and flag any matches for review.
Monitor Grav application logs for Twig compilation errors originating from Flex Objects controllers.
Correlate PHP process telemetry with unexpected child processes to identify post-exploitation command execution.
Enable file integrity monitoring on user/config/scheduler.yaml and page markdown files under Flex Objects collections.

Monitoring Recommendations

Ingest Grav access and error logs into a centralized analytics platform and alert on repeated 500-class responses tied to Flex Objects URLs.
Baseline expected outbound connections from the Grav host to detect reverse shells or payload downloads initiated by the PHP worker.
Track write events to page frontmatter by low-privilege editor accounts and alert on titles containing {{ or {%.

How to Mitigate CVE-2026-58655

Immediate Actions Required

Upgrade getgrav/grav-plugin-flex-objects to version 1.4.0 or later on all Grav instances.
Audit existing Flex Objects pages for Twig expressions in title frontmatter and remove any unrecognized entries.
Review the Grav user database and revoke authoring permissions for accounts that are not actively required.
Inspect user/config/scheduler.yaml for unauthorized job entries and remove any that were not deployed by administrators.

Patch Information

The maintainers fixed the issue in Grav Flex Objects plugin version 1.4.0. The patch removes the call to template_from_string() on frontmatter titles and routes user-controlled values through Grav's standard sanitization. Full remediation details are published in the GitHub Security Advisory GHSA-623v-m3c4-3pw8.

Workarounds

Restrict page authoring capabilities on Flex Objects collections to trusted administrators until the upgrade is applied.
Place the Grav administrative interface behind network-level access controls or a VPN to limit exposure of the authoring surface.
Disable the Flex Objects plugin on public-facing sites where dynamic titles are not required.

bash

# Upgrade the Flex Objects plugin using the Grav CLI
bin/gpm update flex-objects

# Verify the installed version is 1.4.0 or later
bin/gpm info flex-objects | grep -i version

# Audit page frontmatter for Twig expressions in Flex titles
grep -RIn --include='*.md' -E 'title:.*(\{\{|\{%)' user/pages/