CVE-2026-85604: Grav before 2.0.18 Remote Code Execution via sort filter
Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses splautoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes splautoload through the sort filter, resulting in arbitrary PHP execution as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gravto a version that resolves this vulnerability.Fixed in 2.0.18 - Compensating control
Restrict the account(s) that have page-write rights (e.g., admin.pages or api.pages.write) to trusted users only, because an authenticated user with those rights can supply a crafted payload that triggers the Twig sort filter leading to RCE.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with page-write rights can exploit it. The affected privileges are admin.pages or api.pages.write; no administrator-level access is required.
What access and conditions are required for exploitation?
The attacker needs authenticated page-write access and a way to supply crafted content that is rendered through the vulnerable Twig sort filter. The described example is form frontmatter rendered by the Email plugin.
What is the impact of successful exploitation?
Successful exploitation allows arbitrary PHP code execution as the web server user. This can affect confidentiality, integrity, and availability of the affected Grav deployment.
How can I determine whether an installation is affected?
Installations running Grav versions before 2.0.19 are affected; the provided affected-version range is versions 2.0.17 and earlier. Review whether users or API clients have admin.pages or api.pages.write permissions and whether they can submit content that is rendered by Twig.