CVE-2026-56700criticalCWE-502CWE-78

CVE-2026-56700: falha crítica em Grav

Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Grav+ Monitorar getgrav/grav

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 2.5%
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Grav · Grav
CVEs relacionadas — Grav

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58654MEDIUMGrav - Arbitrary File Upload via Avatar EndpointEPSS 0.4%CVE-2026-56701HIGHGrav - XML External Entity Injection via SVG UploadEPSS 0.3%CVE-2020-37256MEDIUMGrav - Cross-Site Scripting in Admin Plugin Page EditorEPSS 0.3%CVE-2026-58657MEDIUMGrav - Stored CSS Injection via Markdown Image resize() ActionEPSS 0.3%