CVE-2026-56700criticalCWE-502CWE-78

CVE-2026-56700: critical vulnerability in Grav

Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection

Published · Updated

Follow this CVE+ Monitor Grav+ Monitor getgrav/grav

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 2.5%
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Grav · Grav
Related CVEs — Grav

In the same product, most dangerous first.

CVE-2026-58654MEDIUMGrav - Arbitrary File Upload via Avatar EndpointEPSS 0.4%CVE-2026-56701HIGHGrav - XML External Entity Injection via SVG UploadEPSS 0.3%CVE-2020-37256MEDIUMGrav - Cross-Site Scripting in Admin Plugin Page EditorEPSS 0.3%CVE-2026-58657MEDIUMGrav - Stored CSS Injection via Markdown Image resize() ActionEPSS 0.3%