Description
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav | < 4.2.2 | 4.2.2 |
References
- GitHub Security Advisory (GHSA-gh8j-q67c-j53f) vendor-advisory
- VulnCheck Advisory: Grav before 4.2.2 Remote Code Execution via Email Twig third-party-advisory