{"id":"CVE-2026-109318","published":"2026-10-12T17:17:26.807","lastModified":"2026-10-15T15:12:54.040","description":"Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-c89w-55m3-fmf7","tags":[]},{"url":"https://www.vulncheck.com/advisories/grav-git-sync-1.0.2-through-3.4.12-command-injection-via-commit-author","tags":[]}],"exploitRefs":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-c89w-55m3-fmf7","tags":[]}],"hasPoc":true,"ai":{"summary":"Grav Git Sync contains a command injection vulnerability in versions 1.0.2 through 3.4.12 that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. This occurs when git commit --author is used with malicious input, running commands as the web-server account.","exploitability":"Exploitation requires an authenticated content editor account with author mode enabled, making it moderately difficult but possible to achieve with a low-privileged user.","blast_radius":"If exploited, attackers could execute arbitrary OS commands as the web-server account, potentially leading to full server compromise and data exfiltration.","remediation":"Upgrade to Grav Git Sync version 3.4.13 or later to remediate this command injection vulnerability.","detection":"Monitor for unusual git commit author fields in repository logs, particularly those containing shell metacharacters like semicolons or pipes, and watch for unexpected process execution patterns from the web server account.","tags":["rce","command-injection","web","grav"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:54:46.773Z"}}