CVE-2026-85604

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.19

Description A remote code execution issue exists in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes the isSandboxed argument to false, allowing the |sort filter to accept a plain function name within the sandbox. Because the denylist fails to include spl autoload, which performs a PHP include, an authenticated user with page-write permissions (admin.pages or api.pages.write) can provide a crafted payload to invoke spl autoload via the sort filter. This leads to arbitrary PHP execution as the web server user.

Recommendations Update Grav to version 2.0.19 or later.