Remote Code Execution Vulnerability in Grav by GetGrav

CVE-2026-85604

What is CVE-2026-85604?

Grav, a popular flat-file CMS, has a security vulnerability in versions prior to 2.0.19 that allows an authenticated user with minimal privileges to execute arbitrary PHP code on the server. This issue arises from the Twig sort filter, which accepts plain function names due to improper sandboxing. Specifically, the sortFunc in GravExtension.php incorrectly handles the isSandboxed argument, allowing maliciously crafted payloads to exploit the absence of safe function restrictions. An attacker can leverage this flaw by submitting specially crafted data through forms, leading to potential system compromise.

References