CVE-2026-85604 Details
Description
Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes spl_autoload through the sort filter, resulting in arbitrary PHP execution as the web server user.
A remote code execution vulnerability has been identified in Grav versions prior to 2.0.19, specifically in the Twig sort filter. The issue arises because the sortFunc wrapper in GravExtension.php sets Twig's isSandboxed argument to false. This misconfiguration allows the sort filter to accept plain function names within the sandbox, contrary to the behavior of similar filters like map, filter, and reduce. The vulnerability exploits a gap in the denylist, which fails to block spl_autoload, a PHP function that includes files. An authenticated user with page-write permissions can craft a payload, such as through form frontmatter via the Email plugin, that triggers spl_autoload through the sort filter, leading to arbitrary PHP execution as the web server user.
Users are advised to update Grav to version 2.0.19 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-p6qj-p5m7-f62h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-p6qj-p5m7-f62h | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-before-2.0.19-remote-code-execution-via-sort-filter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | <= 2.0.17 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | CVE Modified | [email protected] |
| Sep 4, 2026 | New CVE Received | [email protected] |