Read the docs
TI-2026-71134 Aliases CVE-2026-109318GHSA-cp28-795p-j89g

OS command injection in Grav Git Sync via commit author fields

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Grav Git Sync from 1.0.2 before 3.4.13 contains a command injection flaw (CWE-78) in how it builds git commit author values from user profile fields. When the gravuser or gravfull author mode is enabled, an authenticated content editor can insert shell substitutions into the username, full name, or email, and these values are passed to PHP exec() so that commands run as the web-server account. The CVSS 4.0 vector rates the attack as low complexity and requires low privileges, with high impact on confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0122 68th percentileScored 2026-11-08
Fix Fixed grav-plugin-git-sync (trilbymedia): 3.4.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Trilby Mediagrav-plugin-git-sync1.0.2 to before 3.4.133.4.13Patch availableCNA
  • grav-plugin-git-sync VendorTrilby Media Affected 1.0.2 to before 3.4.13 Fixed in 3.4.13 Patch available CNA

Remediation

Update trilbymedia grav-plugin-git-sync to version 3.4.13 or later, which fixes the flaw. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA grav-plugin-git-sync (trilbymedia) Fixed in 3.4.13

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109318
  2. 2026-10-12 Alias added: GHSA-cp28-795p-j89g
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: MEDIUM → LOW
  5. 2026-10-13 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2026-51057 Grav through 2.0.11 Authentication Bypass via Flex Objects CVSS 4.0HIGH 8.7
  • TI-2026-09863 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit CVSS 4.0MEDIUM 6.9
  • TI-2026-41658 Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences