CVE-2026-58655

Name of the Vulnerable Software and Affected Versions Grav Flex Objects plugin versions prior to 1.4.0

Description A stored server-side template injection exists when rendering dynamic collection or object titles. The plugin passes user-controlled frontmatter values page.header.flex.collection.title or page.header.flex.object.title to the Twig template from string() function, which causes them to be evaluated as Twig code instead of plain text. This process bypasses the Security::cleanDangerousTwig() sanitization function. An attacker capable of controlling the title frontmatter of a publicly reachable Flex Objects page can execute arbitrary Twig code and potentially escalate to remote command execution by accessing internal Grav services like the scheduler.

Recommendations Update Grav Flex Objects plugin to version 1.4.0 or later.