Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-109318: Grav Git Sync lets editors run commands on server

CVE-2026-109318 · published 23 days ago

Summary

Versions 1.0.2 through 3.4.12 of Grav Git Sync let a logged‑in content editor place special characters in their name or email fields. Those characters are passed to the system’s command line when the software creates a Git commit, allowing the editor to run any command as the web‑server user. Disable the author‑editing feature or upgrade to a version that sanitises these fields.

Original advisory text

Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.

References

https://github.com/getgrav/grav/security/advisories/GHSA-c89w-55m3-fmf7 Vendor Advisory
https://www.vulncheck.com/advisories/grav-git-sync-1.0.2-through-3.4.12-command-... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1093... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-109318 Vendor Advisory
https://github.com/trilbymedia/grav-plugin-git-sync Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published12 Oct 2026

Updated4 Nov 2026

First seen12 Oct 2026

Sources

CVE-2026-109318 · NVD

CVE-2026-109318 · OSV

GHSA-c89w-55m3-fmf7 · GHSA

Track software like this

Free during beta