CVE-2026-109318: Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Q: Who can exploit this issue?

An authenticated user with content editor access can exploit it. The injected commands execute as the web-server account.

Q: What configuration is required for exploitation?

The vulnerable path requires the Git Sync plugin to use either the gravuser or gravfull commit author mode. In those modes, a username, full name, or email from profile fields is passed into git commit --author.

Q: What input does an attacker need to control?

The attacker needs to set shell substitutions in their profile username, full name, or email field. Those values can reach PHP exec() through the commit author argument.

Q: Are all listed versions affected by default?

The provided information identifies versions 1.0.2 through 3.4.12 as affected, but only describes exploitation when gravuser or gravfull author mode is enabled. It does not establish that those modes are enabled by default.

Published Oct 12, 2026

Updated

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.

Affected Software

1 affected component

Grav Git Sync>=1.0.2<=3.4.12

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with content editor access can exploit it. The injected commands execute as the web-server account.

What configuration is required for exploitation?

The vulnerable path requires the Git Sync plugin to use either the gravuser or gravfull commit author mode. In those modes, a username, full name, or email from profile fields is passed into git commit --author.

What input does an attacker need to control?

The attacker needs to set shell substitutions in their profile username, full name, or email field. Those values can reach PHP exec() through the commit author argument.

Are all listed versions affected by default?

The provided information identifies versions 1.0.2 through 3.4.12 as affected, but only describes exploitation when gravuser or gravfull author mode is enabled. It does not establish that those modes are enabled by default.

CVE-2026-109318: Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What configuration is required for exploitation?

What input does an attacker need to control?

Are all listed versions affected by default?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What configuration is required for exploitation?

What input does an attacker need to control?

Are all listed versions affected by default?