CVE-2026-75574

Name of the Vulnerable Software and Affected Versions Grav Email plugin versions prior to 4.2.2

Description An authenticated remote user with api.access and api.pages.write permissions can execute arbitrary operating-system commands as the account running PHP. This occurs because the plugin renders Email action parameters controlled by the page editor as unsandboxed Twig templates. An attacker can achieve this by placing a Twig expression in the header.form.process.email.body parameter, publishing the page, and submitting the form. Twig is a template engine used to generate HTML or other text formats dynamically.

Recommendations Update Grav Email plugin to version 4.2.2 or later.