CVE-2026-109318: Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with content editor access can exploit it. The injected commands execute as the web-server account.
What configuration is required for exploitation?
The vulnerable path requires the Git Sync plugin to use either the gravuser or gravfull commit author mode. In those modes, a username, full name, or email from profile fields is passed into git commit --author.
What input does an attacker need to control?
The attacker needs to set shell substitutions in their profile username, full name, or email field. Those values can reach PHP exec() through the commit author argument.
Are all listed versions affected by default?
The provided information identifies versions 1.0.2 through 3.4.12 as affected, but only describes exploitation when gravuser or gravfull author mode is enabled. It does not establish that those modes are enabled by default.