CVE-2026-75574 Overview
CVE-2026-75574 is a server-side template injection vulnerability in the Grav Email plugin (getgrav/grav-plugin-email) affecting versions before 4.2.2. The plugin renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated user with only api.access and api.pages.write permissions can embed a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute arbitrary operating-system commands as the PHP account. The flaw maps to [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].
Critical Impact
Low-privileged authenticated users can achieve remote code execution on the web server, leading to full compromise of the Grav CMS host.
Affected Products
- Grav CMS Email plugin (getgrav/grav-plugin-email) versions before 4.2.2
- Grav CMS instances that enable the Email plugin form processing action
- Deployments granting api.access and api.pages.write permissions to non-administrative users
Discovery Timeline
- 2026-08-25 - CVE-2026-75574 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-75574
Vulnerability Analysis
The Grav Email plugin processes form submissions by invoking a configurable Email action defined in a page's frontmatter. Fields under header.form.process.email, including the body field, are passed through the Twig template engine before the message is dispatched. The plugin performs this rendering without a sandbox, meaning attacker-supplied Twig syntax can call PHP functions.
Because page content is editable through the admin API by any account holding api.access and api.pages.write, an attacker does not need administrator rights. Submitting the crafted form triggers server-side evaluation of the injected Twig expression. The resulting command runs under the identity of the PHP worker (typically www-data or the application user), granting the attacker code execution, file read/write, and lateral pivot capability inside the web tier.
Root Cause
The root cause is trusting page-editor-controlled fields as safe template input. The Email plugin renders header.form.process.email.* values with an unsandboxed Twig environment, bypassing the security controls Twig offers through its sandbox extension. Editor permissions are treated as sufficient trust, but they do not equate to shell access on the host.
Attack Vector
Exploitation requires an authenticated session with api.access and api.pages.write. The attacker edits or creates a page whose frontmatter defines a form with an email process action containing a Twig payload in the body parameter. After publishing the page, the attacker submits the form over HTTP. Grav renders the malicious template, and Twig evaluates the expression, invoking PHP functions such as system or passthru to run the operating-system command. Refer to the GitHub Security Advisory GHSA-gh8j-q67c-j53f and the VulnCheck Advisory on Grav RCE for technical details.
Detection Methods for CVE-2026-75574
Indicators of Compromise
- Page frontmatter or Markdown files containing Twig control tokens such as {{, }}, {%, or references to system, passthru, shell_exec, or proc_open within form.process.email blocks.
- Unexpected child processes (for example, /bin/sh, bash, curl, wget) spawned by the PHP-FPM or web server process.
- Outbound network connections initiated by the web server user immediately after form POSTs to Grav pages.
Detection Strategies
- Inspect user/pages/**/*.md for form definitions where process.email.body contains Twig expressions rather than static text.
- Review Grav admin audit logs for api.pages.write events performed by non-administrator accounts, especially page edits that add form processors.
- Correlate HTTP POSTs to Grav form endpoints with process-execution telemetry on the underlying host.
Monitoring Recommendations
- Alert on new or modified pages authored by low-privilege API users, particularly those introducing form actions.
- Baseline the child processes of the PHP runtime and alert on deviations such as shell interpreters or network utilities.
- Track egress traffic from the web server host to detect post-exploitation callbacks or data exfiltration.
How to Mitigate CVE-2026-75574
Immediate Actions Required
- Upgrade the Grav Email plugin to version 4.2.2 or later on every Grav CMS instance.
- Audit accounts that hold api.access and api.pages.write and revoke permissions that are not strictly required.
- Review recently modified pages for Twig payloads inside form processors and remove any suspicious content.
Patch Information
The maintainers released getgrav/grav-plugin-email version 4.2.2, which neutralizes attacker-controlled Twig input in Email action parameters. Update through the Grav Package Manager (bin/gpm update email) or by pulling the fixed release from the plugin repository. See the GitHub Security Advisory GHSA-gh8j-q67c-j53f for the fix details.
Workarounds
- Disable the Email plugin until the patched version can be deployed.
- Restrict page-authoring permissions so that only trusted administrators can create or modify pages containing form processors.
- Place the Grav admin interface behind network access controls or a VPN to limit exposure of the authenticated attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
