CVE-2026-58655 getgrav CVE debrief

Who should care

Defenders and administrators of Grav installations using the Flex Objects plugin should assess exposure and prioritize remediation. This vulnerability requires verification of affected versions and deployment contexts to determine the risk of exploitation.

Why it matters

CVE-2026-58655 is a high-severity vulnerability in the Grav Flex Objects plugin that allows for stored server-side template injection. Defenders and administrators of Grav installations should assess exposure and prioritize remediation to prevent potential exploitation and remote command execution.

• Potential for arbitrary Twig execution and remote command execution via access to internal Grav services
• Risk of exploitation through publicly reachable Flex Objects pages
• Need for verification of affected versions and deployment contexts

Technical summary

The Grav Flex Objects plugin before version 1.4.0 is vulnerable to stored server-side template injection due to improper handling of user-controlled frontmatter values in Twig templates. An attacker who can control the title frontmatter of a publicly reachable Flex Objects page can achieve arbitrary Twig execution and potentially escalate to remote command execution via access to internal Grav services. This vulnerability requires verification of affected versions and deployment contexts to determine the risk of exploitation. The plugin passes user-controlled frontmatter values to Twig's template_from_string(), causing them to be evaluated as Twig code rather than treated as text. This path bypasses Grav's and

Defensive priority

High

Recommended defensive actions

• Review and update Grav Flex Objects plugin to version 1.4.0 or later
• Restrict access to Flex Objects pages to prevent unauthorized users from controlling title frontmatter
• Monitor for suspicious activity and implement additional security measures to prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Grav Flex Objects plugin. The plugin is vulnerable to stored server-side template injection due to improper handling of user-controlled frontmatter values in Twig templates. This allows an attacker to execute arbitrary Twig code and potentially escalate to remote command execution via access to internal Grav services.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.