Grav Flex Objects Plugin < 1.4.0 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/grav-flex-objects-plugin--1.4.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 15 Jul 2026 12:25:11 +0000Grav Flex Objects Plugin Stored Template Injection Leading to RCEhttps://feed.craftedsignal.io/briefs/2026-07-grav-flex-objects-rce/Wed, 15 Jul 2026 12:25:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-grav-flex-objects-rce/A stored server-side template injection vulnerability, identified as CVE-2026-58655, exists in the Grav Flex Objects plugin before version 1.4.0, allowing an attacker to achieve arbitrary Twig execution and remote command execution by injecting malicious code into user-controlled title frontmatter that bypasses sanitization.A critical stored server-side template injection vulnerability, CVE-2026-58655, affects the bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) in versions prior to 1.4.0. This flaw allows an attacker to inject and execute arbitrary Twig code by manipulating the page.header.flex.collection.title or page.header.flex.object.title frontmatter values. The plugin's template_from_string() function insecurely processes these user-controlled inputs as executable Twig code during dynamic collection or object title rendering, effectively bypassing Grav's Security::cleanDangerousTwig() sanitization. Successful exploitation grants an unauthenticated attacker remote command execution capabilities on the vulnerable Grav instance, potentially through access to internal Grav services like the scheduler. This could lead to full system compromise and data exfiltration.

Attack Chain

  1. An attacker identifies a publicly accessible Grav Flex Objects page.
  2. The attacker crafts malicious Twig template code designed to achieve arbitrary command execution, possibly leveraging internal Grav services like the scheduler.
  3. The attacker injects this malicious Twig code into the title frontmatter (e.g., page.header.flex.collection.title or page.header.flex.object.title) of the target Flex Objects page.
  4. The Grav Flex Objects plugin receives and stores the maliciously crafted frontmatter.
  5. When the affected page's title is dynamically rendered, the plugin's template_from_string() function attempts to process the user-controlled frontmatter.
  6. The template_from_string() function evaluates the injected malicious string as Twig code due to the vulnerability, bypassing security sanitization.
  7. The embedded Twig code executes on the server, leading to arbitrary code execution and potential escalation to remote command execution.
  8. The attacker's commands are executed on the host system, enabling full compromise or data exfiltration.

Impact

Successful exploitation of CVE-2026-58655 results in remote code execution (RCE) on the compromised Grav instance. An attacker can gain full control over the affected web server, including the ability to install backdoors, steal sensitive data, modify website content, or use the server as a platform for further attacks. This vulnerability poses a severe risk to the integrity and confidentiality of the Grav installation and any data it manages. While specific victim counts are not available, all Grav installations using the Flex Objects plugin prior to version 1.4.0 are at risk.

Recommendation

  • Upgrade the Grav Flex Objects plugin to version 1.4.0 or newer immediately to patch CVE-2026-58655.
  • Deploy the provided Sigma rule to your SIEM to detect attempts at server-side template injection via suspicious Twig syntax in web requests.
  • Enable comprehensive web server logging, including full URI query strings and POST body parameters, to capture evidence for the detection rule.
]]>highadvisorytemplate-injectionrceweb-vulnerabilitycmsgravphp