CVE-2026-56700

CRITICAL 9.8

Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.

CWE	CWE-78 CWE-502
Vendor	grav
Product	grav
Published	Jun 30, 2026

Stay Ahead of the Next One

Get instant alerts for grav grav

Be the first to know when new critical vulnerabilities affecting grav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Grav / Grav

0 < 2.0.0-beta.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-vj3m-2g9h-vm4p vulncheck.com: https://www.vulncheck.com/advisories/grav-multiple-remote-code-execution-vulnerabilities-via-unsafe-unserialize-and-command-injection

Credits

🔍 Proscan-one