CVE-2026-56700: Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav CMSto a version that resolves this vulnerability.Fixed in 2.0.0-beta.2 - Compensating control
The command injection via InstallCommand's git clone operation requires admin access; restrict/admin harden access so only trusted administrators can perform plugin/theme installations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56700?
CVE-2026-56700 has a critical severity rating of 9.8.
How do I fix CVE-2026-56700?
To fix CVE-2026-56700, update Grav CMS to version 2.0.0-beta.2 or later.
What type of vulnerabilities does CVE-2026-56700 contain?
CVE-2026-56700 contains multiple remote code execution vulnerabilities including unsafe unserialize and command injection.
What are the consequences of exploiting CVE-2026-56700?
Exploitation of CVE-2026-56700 can lead to unauthorized remote code execution, compromising the affected Grav CMS instance.
Which components of Grav CMS are affected by CVE-2026-56700?
CVE-2026-56700 affects the Scheduler",