CVE-2026-109318
Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.
| CWE | CWE-78 |
| Vendor | trilbymedia |
| Product | grav-plugin-git-sync |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for trilbymedia grav-plugin-git-sync
Be the first to know when new high vulnerabilities affecting trilbymedia grav-plugin-git-sync are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
trilbymedia / grav-plugin-git-sync
1.0.2 < 3.4.13
References
Credits
🔍 AlpetGexha