The Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) prior to version 1.4.0 contains a stored server-side template injection vulnerability. Specifically, when rendering dynamic collection or object titles, user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) are passed directly to Twig's template_from_string() function. This causes these values to be evaluated as Twig code rather than treated as plain text, bypassing Grav's Security::cleanDangerousTwig() sanitization. An attacker able to control these frontmatter titles on a publicly reachable Flex Objects page can achieve arbitrary Twig code execution, which can escalate to remote command execution by leveraging internal Grav services such as the scheduler.

Successful exploitation allows an attacker to execute arbitrary Twig code on the server, leading to potential remote command execution. This can compromise the confidentiality, integrity, and availability of the affected system. The vulnerability requires the attacker to have the ability to control the title frontmatter of a publicly accessible Flex Objects page, but no user interaction or privileges beyond low-level access are required. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict or monitor access to Flex Objects pages that allow user-controlled frontmatter titles. Avoid exposing such pages publicly or limit the ability of untrusted users to modify frontmatter titles. Follow vendor advisories for updates and apply official fixes once released.