CVE-2026-75574: Grav before 4.2.2 Remote Code Execution via Email Twig
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user needs only the api.access and api.pages.write permissions. No user interaction is required once the attacker can edit and publish a page.
What does exploitation require?
The attacker must be able to place a Twig expression in header.form.process.email.body, publish the page, and submit the form. The Email action parameters are rendered as unsandboxed Twig templates.
What is the impact if exploitation succeeds?
The attacker can execute arbitrary operating-system commands with the privileges of the account running PHP. This can affect confidentiality, integrity, and availability.
Which versions are affected?
Versions of the Grav Email plugin before 4.2.2 are affected.