CyberRota Analysis
AI-GeneratedThe Grav Email plugin prior to version 4.2.2 is vulnerable due to the unsandboxed rendering of user-controlled Twig templates, allowing authenticated remote users with limited permissions to inject and execute arbitrary operating-system commands. This poses a significant risk as it can lead to unauthorized command execution on the server, potentially compromising the entire system. Organizations using this plugin should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.