{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-109318/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:grav:git_sync:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-109318"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Git Sync (1.0.2 - 3.4.12)"],"_cs_severities":["high"],"_cs_tags":["web-application","command-injection","cve-2026-109318"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eGrav Git Sync plugin versions 1.0.2 through 3.4.12 are susceptible to a command injection vulnerability (CVE-2026-109318). The flaw exists when the plugin is configured with 'gravuser' or 'gravfull' author mode, which facilitates Git commits using user-provided profile metadata. An authenticated content editor can inject shell metacharacters into the 'username', 'full name', or 'email' fields within the user profile. The application improperly sanitizes these inputs before passing them to the 'git commit --author' command via the PHP 'exec()' function. Successful exploitation allows an attacker to execute arbitrary system commands under the security context of the web-server process, potentially leading to unauthorized system access, data exfiltration, or further lateral movement within the hosting environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability impacts organizations utilizing the Grav CMS with the affected Git Sync plugin versions. Because the vulnerability requires authentication, the impact is primarily lateral escalation from a compromised content editor account to full OS-level control on the web server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Grav Git Sync plugin to a version later than 3.4.12 as soon as a security patch is available.\u003c/li\u003e\n\u003cli\u003eAudit user profiles within the Grav CMS for any characters that deviate from standard alphanumeric patterns in 'username', 'full name', or 'email' fields.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Grav CMS administrative interface to trusted users to mitigate the risk of authenticated exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs and process execution logs for suspicious child processes spawned by the web-server user (e.g., www-data, apache, nginx) following user profile update actions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:35:16Z","date_published":"2026-10-12T18:35:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grav-git-sync-command-injection/","summary":"Grav Git Sync versions 1.0.2 through 3.4.12 contain a command injection vulnerability allowing authenticated users to execute OS commands via malicious profile inputs.","title":"Command Injection in Grav Git Sync Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-grav-git-sync-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-109318","version":"https://jsonfeed.org/version/1.1"}