CVE-2026-75829: Grav Plugin API SSRF Vulnerability

CVE-2026-75829 Overview

CVE-2026-75829 is a server-side template injection (SSTI) vulnerability in the grav-plugin-api component for the Grav content management system. Versions prior to 1.0.15 fail to validate Twig content submitted to the translate() endpoint. An authenticated attacker with the api.pages.write permission can persist pages with process.twig enabled and inject crafted header and content parameters. The template engine then evaluates the payload at render time, resulting in code execution within the Grav application context. The issue is tracked under [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].

Critical Impact
Authenticated attackers can achieve server-side code execution through Twig template injection, compromising confidentiality and integrity of the Grav application.

Affected Products

grav-plugin-api versions before 1.0.15
Grav CMS instances with the API plugin installed and enabled
Deployments granting api.pages.write permission to non-administrative users

Discovery Timeline

2026-08-18 - CVE-2026-75829 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75829

Vulnerability Analysis

The grav-plugin-api plugin exposes a translate() endpoint that accepts header and content parameters used to build page objects. The endpoint does not neutralize Twig syntax in these inputs before persisting them to disk. When a page is later requested, Grav's Twig engine evaluates the stored template because process.twig is enabled on the page. This turns a data-write API into a template execution primitive.

Attackers with the api.pages.write scope can submit payloads containing Twig control structures, filters, and function calls. These constructs invoke PHP methods available to the template context, leading to arbitrary command execution on the underlying host.

Root Cause

The root cause is missing input validation and output sanitization in the translate handler. The plugin treats user-supplied header and content fields as trusted template source rather than opaque content. Combined with the process.twig flag being controllable through the same request, the vulnerability creates a direct path from authenticated API access to template-driven code execution.

Attack Vector

Exploitation requires network access to the Grav API and a valid account with the api.pages.write privilege. The attacker sends a POST request to the vulnerable translate() endpoint with Twig expressions embedded in the page header or body and process.twig set to true. The malicious page is written to the Grav pages directory. Subsequent rendering of that page causes the Twig engine to evaluate the injected expressions server-side. Refer to the GitHub Security Advisory and VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-75829

Indicators of Compromise

Pages under the Grav user/pages/ directory containing Twig expressions such as {{ ... }} or {% ... %} in unexpected locations, especially within header fields.
Page front matter with process: twig: true set on content not authored by administrators.
API access logs showing POST requests to the translate() endpoint originating from non-editorial accounts.

Detection Strategies

Inspect version metadata of the grav-plugin-api plugin and flag any deployment on a release earlier than 1.0.15.
Review recently modified page files for Twig syntax, PHP function names, or references to _self, getEnvironment, or registerUndefinedFilterCallback.
Correlate web access logs with authentication logs to identify low-privilege accounts issuing writes to the pages API.

Monitoring Recommendations

Alert on new or modified files in user/pages/ created outside expected editorial workflows.
Monitor the Grav PHP process for unexpected child processes such as sh, bash, curl, or wget.
Track API tokens and sessions holding api.pages.write and review scope assignments regularly.

How to Mitigate CVE-2026-75829

Immediate Actions Required

Upgrade grav-plugin-api to version 1.0.15 or later on all Grav instances.
Audit accounts and API tokens that hold the api.pages.write permission and revoke any that are not required.
Review all pages created or modified since the plugin was installed for Twig payloads and remove suspicious content.

Patch Information

The vendor released grav-plugin-api1.0.15, which adds validation of Twig content submitted through the translate() endpoint. Patch details are documented in the GitHub Security Advisory GHSA-w94c-jmg4-w4c9.

Workarounds

Restrict access to the Grav API using network controls such as IP allowlists or a reverse proxy requiring additional authentication.
Disable the grav-plugin-api plugin until patching is complete if the API is not required for operations.
Enforce least privilege by removing api.pages.write from all non-administrator roles and rotating exposed API tokens.

bash

# Configuration example: verify plugin version and disable if vulnerable
cd /path/to/grav
bin/gpm info api
bin/gpm update api
# If patching is not immediately possible, disable the plugin:
bin/plugin api uninstall