CVE-2026-85604

Grav CMS before 2.0.18 contains a remote code execution flaw in its Twig sandbox: the sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map, |filter, and |reduce, the |sort filter accepts a plain PHP function name inside the sandbox, and the function denylist omits spl_autoload, which performs a PHP include. An authenticated user holding only page-write rights (admin.pages or api.pages.write) can plant a crafted payload, for example in form frontmatter rendered by the Email plugin, that invokes spl_autoload through the sort filter. Successful invocation yields arbitrary PHP execution as the web server user on the host, effectively a full code-execution foothold on the site. Any Grav deployment running 2.0.17 or earlier in which such limited-privilege users or API tokens can write page content is affected. There is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts 30-day exploitation risk at about 0.5% (40th percentile), so no exploitation is currently known.

What to do: Upgrade Grav to 2.0.18 or later. Until patched, restrict admin.pages and api.pages.write to fully trusted users and API credentials, and review form frontmatter rendered by the Email plugin for unexpected Twig |sort payloads; check logs for calls to spl_autoload originating from Twig templates.