CVE-2026-56700 – Multiple RCE (PHP Object Injection, OS Command Injection, SSTI) – Grav CMS befor…

Summary

CVE-2026-56700 is a critical, multi-vector remote code execution vulnerability affecting Grav CMS in all versions prior to 2.0.0-beta.2. The CVE bundles five distinct weaknesses across three vulnerability classes — unsafe PHP deserialization, OS command injection, and server-side template injection — with a CVSS v3.1 score of 9.8 (Critical). The most severe vectors require no authentication and are directly reachable over the network, making exposed Grav instances a high-priority target.

Technical details

• Root cause (PHP Object Injection – x3): Three components — SchedulerJobQueue, FrameworkCacheAdapterFileCache, and Session — call unserialize() on externally influenced data with allowed_classes => true, imposing no restriction on which PHP classes may be instantiated. An attacker who can influence the serialized input can inject a crafted object; the JobQueue‘s use of call_user_func_array() on deserialized data provides a ready gadget chain for arbitrary code execution. The Session component is the most critical of the three: session storage is client-controlled and accessible pre-authentication, requiring no existing foothold.
• Root cause (OS Command Injection): InstallCommand‘s git clone operation concatenates the $data['branch'], $data['url'], and $data['path'] parameters directly into a shell command without sanitization or quoting. An authenticated administrator installing a plugin or theme can inject arbitrary shell commands via these parameters.
• Root cause (Twig SSTI blocklist bypass): The Twig security filter in Security.php fails to block twig_array_reduce, twig_array_some, twig_array_every, and other dangerous callables, allowing an attacker with template injection access to bypass the sandbox and execute server-side code.
• Trigger conditions: The deserialization and SSTI vectors require no authentication. The command injection vector requires admin panel access.
• Attack vector: Network (HTTP/HTTPS); the Session deserialization path is pre-authentication.
• Impact: Full confidentiality, integrity, and availability compromise of the underlying server — arbitrary code execution as the web server process user.

Affected software

• Grav CMS — all versions from the initial release up to and including any version prior to 2.0.0-beta.2

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate — Upgrade: Update Grav CMS to version 2.0.0-beta.2 or later. The patch (commit c66dfeb) introduces HMAC-based integrity verification for all serialized data in JobQueue, FileCache, and Session; wraps InstallCommand git arguments with escapeshellarg() and an option-injection separator; and expands the Twig dangerous-callable blocklist.
• If immediate patching is not feasible:
  • Restrict network access to the Grav admin panel to trusted IP ranges to eliminate the command injection attack surface.
  • Consider temporarily disabling plugin/theme installation functionality via the admin panel.
  • Note: there is no effective workaround for the pre-authentication Session deserialization and SSTI vectors short of applying the patch, as these are reachable by unauthenticated HTTP requests.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-56700 at NIST
• GitHub Security Advisory GHSA-vj3m-2g9h-vm4p (Grav)