CVE-2026-75574: Grav before 4.2.2 Remote Code Execution via Email Twig

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-10-12
Weakness: CWE-1336

Description

The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.

Affected products

getgrav grav: before 4.2.2 — fixed in 4.2.2

How to fix

Upgrade to a fixed version: getgrav grav 4.2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-75574 or the next vulnerability affects your stack