{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav-plugin-email/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-75574"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["grav-plugin-email"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["getgrav"],"content_html":"\u003cp\u003eThe Grav Email plugin (getgrav/grav-plugin-email) prior to version 4.2.2 contains a critical vulnerability (CVE-2026-75574) arising from improper neutralization of template engine elements. The plugin incorrectly renders user-controlled input from the 'header.form.process.email.body' parameter as unsandboxed Twig templates. An authenticated user possessing 'api.access' and 'api.pages.write' permissions can leverage this flaw to inject arbitrary Twig expressions. When the affected page is processed, the server executes these expressions, leading to command injection and remote code execution (RCE) with the privileges of the underlying web server process. This vulnerability is particularly dangerous in environments where untrusted users are granted administrative or content-authoring roles within the Grav CMS.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target Grav CMS instance with 'api.access' and 'api.pages.write' privileges.\u003c/li\u003e\n\u003cli\u003eAttacker creates or edits a page configuration to define a form object.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a malicious Twig expression payload within the 'header.form.process.email.body' field.\u003c/li\u003e\n\u003cli\u003eAttacker publishes the crafted page to the Grav site.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the form processing logic by submitting the specific page form via a web browser or API client.\u003c/li\u003e\n\u003cli\u003eThe Grav Email plugin parses the user-controlled 'email.body' header.\u003c/li\u003e\n\u003cli\u003eThe Twig engine processes the unsandboxed template, executing the attacker-supplied command.\u003c/li\u003e\n\u003cli\u003eThe web server process executes the arbitrary OS command, leading to full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full remote code execution on the server hosting the Grav CMS. An attacker can gain control over the web server, allowing for unauthorized access to sensitive application data, site defacement, or lateral movement within the hosting network. The vulnerability impacts all installations running Grav Email plugin versions prior to 4.2.2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate update of the Grav Email plugin to version 4.2.2 or later to mitigate CVE-2026-75574. Audit existing Grav CMS user accounts to identify and restrict users with 'api.access' and 'api.pages.write' permissions to minimize the attack surface. Deploy web application firewall (WAF) rules to inspect form submissions for suspicious Twig syntax and patterns consistent with template injection.\u003c/p\u003e\n\u003ch2 id=\"rules\"\u003eRules\u003c/h2\u003e\n\u003cp\u003etitle: \u0026quot;Detect Grav Email Plugin Twig Injection Attempt\u0026quot;\ndescription: \u0026quot;Detects potential CVE-2026-75574 exploitation where Twig template syntax is injected into form parameters\u0026quot;\nlogsource:\ncategory: webserver\ndetection:\nselection:\ncs-uri-stem|contains: \u0026quot;/api/pages\u0026quot;\ncs-method: \u0026quot;POST\u0026quot;\ncs-uri-query|contains:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u0026quot;{{\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;{%\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;_self\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;system(\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;exec(\u0026quot;\ncondition: selection\nlevel: high\ntags:\u003c/li\u003e\n\u003cli\u003eattack.execution\u003c/li\u003e\n\u003cli\u003eattack.t1059.003\nfalsepositives:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Legitimate administrative use of Twig templates in page headers\u0026quot;\ntests:\npositive:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Twig injection attempt in POST body\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-uri-stem: \u0026quot;/api/pages/save\u0026quot;\ncs-method: \u0026quot;POST\u0026quot;\ncs-uri-query: \u0026quot;body={{system('id')}}\u0026quot;\nnegative:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Standard page update\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-uri-stem: \u0026quot;/api/pages/save\u0026quot;\ncs-method: \u0026quot;POST\u0026quot;\ncs-uri-query: \u0026quot;body=contact_form\u0026quot;\nhandoff:\ndetection_confidence: \u0026quot;high\u0026quot;\nrequired_telemetry:\u003c/li\u003e\n\u003cli\u003elog_source: \u0026quot;webserver access logs\u0026quot;\nevent_or_channel: \u0026quot;HTTP request logging\u0026quot;\nrequired_fields:\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-stem\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-method\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-query\u0026quot;\navailability: \u0026quot;available\u0026quot;\nnotes: \u0026quot;Requires logging of POST request bodies or query parameters\u0026quot;\nvalidation:\nstatus: \u0026quot;needs_environment_validation\u0026quot;\nsteps:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Attempt to save a page with a non-malicious Twig expression in a lab environment\u0026quot;\nexpected_telemetry: \u0026quot;Web server access log entry showing the POST request\u0026quot;\npass_criteria: \u0026quot;Rule matches the injected payload\u0026quot;\nknown_evasions:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Payload obfuscation using encoding\u0026quot;\nlimitations:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Does not detect successful execution, only injection attempts\u0026quot;\ntuning:\u003c/li\u003e\n\u003cli\u003esource: \u0026quot;Administrator activities\u0026quot;\nguidance: \u0026quot;Exclude known administrative IP ranges or service accounts\u0026quot;\nportability_notes:\u003c/li\u003e\n\u003cli\u003eplatform: \u0026quot;Splunk/Elastic\u0026quot;\nnote: \u0026quot;Requires extraction of POST body parameters into searchable fields\u0026quot;\nsuggested_owner: \u0026quot;Detection Engineering\u0026quot;\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T04:06:42Z","date_published":"2026-08-25T04:06:42Z","id":"https://feed.craftedsignal.io/briefs/2026-08-grav-email-rce/","summary":"The Grav Email plugin version 4.2.1 and below allows authenticated attackers to achieve remote code execution by injecting malicious Twig expressions into form processing parameters.","title":"Remote Code Execution in Grav Email Plugin via Twig Injection","url":"https://feed.craftedsignal.io/briefs/2026-08-grav-email-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav-Plugin-Email","version":"https://jsonfeed.org/version/1.1"}