The Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) prior to version 1.4.0 contains a stored server-side template injection vulnerability. Specifically, when rendering dynamic collection or object titles, user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) are passed to Twig's template_from_string() function. This causes these values to be evaluated as Twig code rather than treated as plain text, bypassing Grav's Security::cleanDangerousTwig() sanitization mechanism. An attacker with control over the title frontmatter of a publicly accessible Flex Objects page can execute arbitrary Twig code, which may escalate to remote command execution by leveraging internal Grav services such as the scheduler.

Successful exploitation allows an attacker with limited privileges to execute arbitrary Twig templates on the server, leading to potential remote command execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability has a high CVSS 4.0 score of 8.7, reflecting its severity and ease of exploitation without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or validate user input controlling the frontmatter titles in Flex Objects pages to prevent injection of malicious Twig code. Monitor vendor channels for updates regarding a patch or official remediation.