CVE-2026-85604: Improper Control of Generation of Code ('Code Injection') in getgrav grav

CVE-2026-85604 is a remote code execution vulnerability affecting Grav CMS versions prior to 2.0.18. The issue lies in the Twig sort filter implementation, where the sortFunc wrapper in GravExtension.php sets the isSandboxed argument to false. This improper sandboxing allows the sort filter to accept plain function names, unlike other filters such as map, filter, or reduce. The denylist used to restrict dangerous functions misses spl_autoload, which can perform PHP includes. An authenticated user with page-write rights (admin.pages or api.pages.write) can supply a crafted payload, for example through form frontmatter rendered by the Email plugin, to invoke spl_autoload and achieve arbitrary PHP code execution as the web server user.

An attacker with authenticated page-write permissions can execute arbitrary PHP code on the server hosting Grav CMS. This can lead to full compromise of the web server environment under the web server user context. The vulnerability is high severity with a CVSS 4.0 score of 8.7, indicating a network attack vector with low complexity and no required privileges beyond page-write access.

A fix is available in Grav version 2.0.18. Users should upgrade to version 2.0.18 or later to remediate this vulnerability. Until patched, restrict page-write permissions to trusted users only and avoid exposing the Email plugin or other input vectors that render user-supplied frontmatter.