Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-56700: Grav CMS before 2.0.0-beta.2 allows hackers to run malicious code
CVE-2026-56700
Summary
Grav CMS versions before 2.0.0-beta.2 are at risk of being hacked because of several security flaws. These flaws allow attackers to run malicious code on your website, steal sensitive information, or even take control of your server. To protect your website, update to version 2.0.0-beta.2 or later.
Original title
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize...
Original description
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.
nvd CVSS3.1
9.8
nvd CVSS4.0
9.3
Vulnerability type
CWE-78
OS Command Injection
CWE-502
Deserialization of Untrusted Data
Published: 30 Jun 2026 · Updated: 22 Jul 2026 · First seen: 1 Jul 2026