Multiple remote code execution (RCE) vulnerabilities were discovered in Grav CMS, including unsafe unserialize calls in JobQueue, FileCache, and Session components, a command injection vulnerability in the git clone operation during plugin/theme installation, and a server-side template injection (SSTI) blocklist bypass. These vulnerabilities allow attackers to execute arbitrary commands or inject malicious objects, with the unserialize issues being particularly critical as they do not require admin access if any file write primitive is available. The Grav maintainers have fixed all five issues in version 2.0.0-beta.2 by implementing HMAC integrity checks on serialized data, escaping shell arguments properly, and enhancing the Twig sandbox to block dangerous functions.