External risk intelligence

Grav API Plugin SSTI Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72824

The vulnerability exists in a plugin for a content management system (Grav). Plugins providing API functionality in web-based CMS platforms are commonly deployed as internet-facing services or management interfaces, making them reachable via the public web in typical real-world deployments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Grav API plugin could allow attackers to execute arbitrary code on affected systems. This issue arises from an API key scope bypass, potentially enabling unauthorized actions if specific security settings are enabled. The main concern is confirming relevance and exposure to understand potential impact.

Bypass allows unintended code execution.
Critical for systems with specific security configurations.
Assess exposure and confirm relevance.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by crafting a request to the Grav API that bypasses security checks. This is possible even with a low-privilege API key if it was initially created under a super administrator account. Successful exploitation allows an attacker to execute arbitrary Twig code on the server, leading to remote code execution.

No authentication required.
Triggered via API request with specific parameters.
Results in remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow for remote code execution on a Grav CMS instance when the `security.twig_content.process_enabled` and `editor_enabled` settings are configured in a specific way. This could occur if an attacker crafts a request to a vulnerable API endpoint, bypassing intended scope restrictions on an API key to trigger server-side template injection.

Server-side code execution.
Exploiting API key bypass to inject.
Unauthorized server access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Grav API plugin's PagesController contains an API key scope bypass vulnerability that could lead to server-side template injection and remote code execution. This issue is likely to be actionable by application owners, platform teams, or security teams responsible for the Grav CMS and its plugins. The first practical step is to identify all Grav instances, determine their exposure, and confirm the accountable owner to plan remediation.

Application owners should own the issue.
Verify Twig content processing configuration.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav API plugin?

Grav is a flat-file content management system that stores data in files rather than databases. The Grav API plugin is an extension that allows developers to interact with the CMS programmatically, enabling external applications or scripts to manage content and site settings. It serves as an interface for automation, making it a critical component for sites that rely on remote management or headless publishing workflows.

How does CVE-2026-72824 lead to code execution?

This vulnerability involves a missing authorization check, categorized as CWE-862 (Missing Authorization). The system fails to verify if an API key has the correct permission level to process Twig, a template engine. By bypassing these scope checks, an attacker can submit specially crafted content that the server interprets as executable code rather than plain text, resulting in server-side template injection and full remote code execution.

Do I need a high-privilege account to trigger this?

Not necessarily. The flaw exists because the system incorrectly trusts the origins of certain API keys. If an API key was originally minted on a super administrator account, it can sometimes inherit unintended capabilities even if its assigned scope is limited. However, this bug is only triggered when specific server settings are enabled, such as having Twig content processing active while the editor feature is disabled.

Is my Grav instance vulnerable to this?

Halo Surface Signal flags this as a likely concern because Grav CMS installations often expose management APIs to the public internet. If your API endpoint is reachable from the web, it is accessible to unauthorized parties. You should verify your system's exposure by checking if the API plugin is enabled and reachable, then review your security configuration for Twig processing to determine if your specific environment meets the criteria for exploitation.

How do I respond to this vulnerability?

Your first step is to perform an inventory of all Grav installations within your environment to identify which are running the affected API plugin. Once identified, consult the plugin documentation to verify your current security settings regarding Twig processing. Coordinate with your platform or application team to schedule a patch to the latest version of the Grav API plugin, which addresses the scope bypass, during your next available maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.