CVE-2026-75829

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.15

Description Insufficient validation of Twig content in the 'translate()' endpoint allows users with api.pages.write permission to persist pages with process.twig enabled. By submitting crafted header and content parameters, an attacker can perform server-side template injection, where malicious payloads are executed during the rendering process.

Recommendations Update grav-plugin-api to version 1.0.15 or later.