CVE-2026-56700

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.0-beta.2

Description Multiple issues allow for code execution. Three unsafe unserialize() calls within SchedulerJobQueue, FrameworkCacheAdapterFileCache, and Session deserialize untrusted data without restricting allowed classes. This enables PHP object injection which, through a gadget chain, allows arbitrary code execution when an attacker controls the serialized input. Additionally, the InstallCommand function performs a git clone operation that passes the branch, url, and path parameters into a shell command without escaping, leading to OS command injection during plugin or theme installation for users with admin access. A server-side template injection is also possible via a Twig security blocklist bypass.

Recommendations Update to version 2.0.0-beta.2.