CVE-2026-109318

Name of the Vulnerable Software and Affected Versions Grav Git Sync versions 1.0.2 through 3.4.12

Description Authenticated content editors can execute operating system commands by injecting shell substitutions into profile fields. This occurs when gravuser or gravfull author mode is enabled, allowing attackers to set a malicious username, full name, or email. These inputs reach the PHP exec() function via the git commit --author command, resulting in command execution under the privileges of the web-server account.

Recommendations Update Grav Git Sync to a version later than 3.4.12.