CVE-2026-75574: Improper Neutralization of Special Elements Used in a Template Engine in getgrav grav

The Grav Email plugin (getgrav/grav-plugin-email) versions prior to 4.2.2 improperly neutralize special elements used in the Twig template engine. An authenticated remote user with api.access and api.pages.write permissions can inject a Twig expression into the header.form.process.email.body parameter. This expression is rendered as an unsandboxed Twig template, enabling arbitrary OS command execution under the PHP process account upon form submission.

Successful exploitation allows an authenticated user with limited permissions to execute arbitrary operating system commands on the server running the Grav application. This can lead to full system compromise depending on the privileges of the PHP process. The vulnerability does not require user interaction beyond form submission and does not require higher privileges than api.access and api.pages.write.

No official patch or remediation level is currently confirmed. Users should upgrade to Grav Email plugin version 4.2.2 or later once available. Until then, restrict api.access and api.pages.write permissions to trusted users only and avoid publishing pages that include user-controlled email action parameters. Monitor vendor advisories for updates.