BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56700

EUVD

EUVD-2026-40452

Affected Vendors & Products

Vendor	Product	Version / Range
grav	cms	to 2.0.0-beta.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

Grav CMS versions before 2.0.0-beta.2 have multiple critical security flaws. These include three unsafe unserialize() calls that deserialize untrusted data without restricting allowed classes, which enables PHP object injection and arbitrary code execution through a gadget chain. Additionally, the InstallCommand's git clone operation improperly handles branch, url, and path parameters by passing them into a shell command without escaping, allowing OS command injection during plugin or theme installation, which requires admin access. There is also a Twig security blocklist bypass that leads to server-side template injection. All these issues are fixed in version 2.0.0-beta.2.

Impact Analysis

This vulnerability can have severe impacts including allowing attackers to execute arbitrary code on the server running Grav CMS. Through PHP object injection and OS command injection, attackers can gain control over the system, potentially leading to data breaches, unauthorized access, and full system compromise. The server-side template injection can also be exploited to execute malicious code. These impacts can disrupt service, compromise sensitive data, and damage the integrity and availability of the affected system.

Hi! I’m here to help you understand CVE-2026-56700. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70