The grav-plugin-api versions prior to 1.0.15 fail to neutralize special elements in Twig templates submitted through the translate() endpoint. Attackers who have api.pages.write privileges can craft malicious header and content parameters to persist pages with process.twig enabled. This results in server-side template injection (SSTI), where injected payloads are evaluated at render time, potentially leading to remote code execution or other impacts depending on the payload.

An attacker with api.pages.write permission can exploit this vulnerability to execute arbitrary server-side template code, which may lead to remote code execution or unauthorized actions on the server. The vulnerability requires some level of privilege (api.pages.write) but does not require user interaction or elevated privileges beyond that. The CVSS 4.0 score is 8.6 (high), reflecting the ease of exploitation and potential impact on confidentiality and integrity.

A fixed version 1.0.15 or later of grav-plugin-api should be applied to remediate this vulnerability. Since the affected versions are before 1.0.15, upgrading to 1.0.15 or newer will address the issue. No vendor advisory content was provided to confirm patch status, but the versioning indicates that 1.0.15 is the fixed release. Until patched, restrict api.pages.write permissions to trusted users only.