Remote Code Execution in Grav via Twig sort filter

Grav versions 2.0.17 and earlier are vulnerable to remote code execution (CVE-2026-85604) due to a security flaw in the Twig 'sort' filter. The vulnerability originates in the 'sortFunc' wrapper within 'GravExtension.php', which incorrectly sets the Twig 'isSandboxed' argument to 'false'. While other filters like 'map', 'filter', and 'reduce' correctly maintain sandbox restrictions, the 'sort' filter fails to prevent the use of arbitrary PHP functions. Specifically, the internal denylist fails to block 'spl_autoload', which can be leveraged to perform unauthorized PHP file inclusions. An attacker with minimal 'admin.pages' or 'api.pages.write' privileges can inject a crafted payload into form frontmatter or other page-rendering components, leading to arbitrary code execution under the context of the web server process. Defenders should upgrade to Grav 2.0.19 or later to remediate this vulnerability.

Impact

Successful exploitation of CVE-2026-85604 results in full remote code execution on the server hosting the Grav instance. This allows attackers to bypass application-level access controls, potentially leading to total system compromise, data theft, and persistence. The vulnerability is restricted to authenticated users with page-write capabilities, limiting the attack surface to malicious insiders or compromised administrative accounts.

Recommendation

• Upgrade all instances of Grav to version 2.0.19 or later immediately.
• Audit logs for administrative accounts (admin.pages or api.pages.write permissions) for suspicious activity or anomalous page updates.
• Monitor for unexpected PHP executions originating from the web server process following page modifications.