CVE-2026-58655
Deferred Deferred - Pending Action

Stored Server-Side Template Injection in Grav Flex Objects Plugin

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: VulnCheck

Description
The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(), causing them to be evaluated as Twig code rather than treated as text. This path bypasses Grav's Security::cleanDangerousTwig() sanitization. An attacker who can control the title frontmatter of a publicly reachable Flex Objects page can achieve arbitrary Twig execution and escalate to remote command execution via access to internal Grav services such as the scheduler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-08-04
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-03
NVD
CVE-2026-58655
EUVD
EUVD-2026-44633

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-flex-objects to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored server-side template injection in the Grav Flex Objects plugin (before version 1.4.0). It occurs when user-controlled frontmatter values for dynamic collection or object titles are passed to Twig's template_from_string() function without proper sanitization. This allows attackers to inject and execute arbitrary Twig code, potentially leading to remote command execution via Grav's internal services.

Detection Guidance

Check if the Grav Flex Objects plugin version is below 1.4.0 by inspecting the plugin directory or running composer show getgrav/grav-plugin-flex-objects. Look for pages using Flex Objects with dynamic titles in page frontmatter. Review server logs for unusual Twig template rendering requests or errors.

Impact Analysis

An attacker who controls the title frontmatter of a publicly accessible Flex Objects page can execute arbitrary code on the server. This may lead to data theft, unauthorized access, or full system compromise. The plugin is included in default Grav installations, increasing exposure risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules. A successful exploit may result in data breaches, unauthorized disclosure, or system compromise, all of which are compliance violations.

Mitigation Strategies

Update the Grav Flex Objects plugin to version 1.4.0 or later immediately. Disable the plugin if not in use. Restrict access to admin interfaces and sensitive pages. Monitor for suspicious activity in logs. Apply Grav core updates if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58655. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart