CVE-2026-72824 getgrav CVE debrief

Who should care

Administrators and users of the Grav API plugin, especially those with high-privilege API keys or exposed installations, should be aware of this vulnerability and take immediate action to patch or mitigate the risk.

Technical summary

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.13 contains a vulnerability that allows for server-side template injection (SSTI) and remote code execution. This is due to an API key scope-cap bypass in PagesController::guardTwigContent(), which does not properly consult api_key_scopes. A least-privilege API key scoped only to api.pages.write can enable process.twig on a page save, leading to potential code execution when security.twig_content.process_enabled=true and editor_enabled=false.

Defensive priority

Organizations using the Grav API plugin should prioritize patching to prevent potential server-side template injection attacks.

Recommended defensive actions

• Apply the patch to update the Grav API plugin to version 1.0.13 or later.
• Restrict API key scopes to the minimum required for each use case.
• Monitor for suspicious activity related to Twig content processing.
• Consider implementing additional security measures, such as Web Application Firewalls (WAFs), to detect and prevent potential attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-72824 record indicates a high-severity vulnerability in the Grav API plugin, with a CVSS score of 8.7. The vulnerability allows for server-side template injection and remote code execution due to an API key scope-cap bypass. Evidence is based on official CVE and NVD records, as well as advisories from the vendor and Vulncheck.

Official resources