Command Injection in Grav Git Sync Plugin

Grav Git Sync plugin versions 1.0.2 through 3.4.12 are susceptible to a command injection vulnerability (CVE-2026-109318). The flaw exists when the plugin is configured with 'gravuser' or 'gravfull' author mode, which facilitates Git commits using user-provided profile metadata. An authenticated content editor can inject shell metacharacters into the 'username', 'full name', or 'email' fields within the user profile. The application improperly sanitizes these inputs before passing them to the 'git commit --author' command via the PHP 'exec()' function. Successful exploitation allows an attacker to execute arbitrary system commands under the security context of the web-server process, potentially leading to unauthorized system access, data exfiltration, or further lateral movement within the hosting environment.

Impact

This vulnerability impacts organizations utilizing the Grav CMS with the affected Git Sync plugin versions. Because the vulnerability requires authentication, the impact is primarily lateral escalation from a compromised content editor account to full OS-level control on the web server.

Recommendation

• Update the Grav Git Sync plugin to a version later than 3.4.12 as soon as a security patch is available.
• Audit user profiles within the Grav CMS for any characters that deviate from standard alphanumeric patterns in 'username', 'full name', or 'email' fields.
• Restrict access to the Grav CMS administrative interface to trusted users to mitigate the risk of authenticated exploitation.
• Monitor web server logs and process execution logs for suspicious child processes spawned by the web-server user (e.g., www-data, apache, nginx) following user profile update actions.