Grav CMS Server-Side Template Injection in Email Actions

Grav CMS versions before 2.0.13 suffer from a critical server-side template injection (SSTI) vulnerability in email-action parameters that directly impacts content management security. Low-privileged page editors can inject malicious Twig template code through email subject, body, to, and from fields, bypassing the sandbox protections that should restrict template operations. When forms are submitted, these unsanitized Twig payloads—particularly leveraging the unsandboxed find filter—execute with application privileges, enabling remote code execution on the underlying operating system. This vulnerability matters because it transforms a common CMS role (page editor) into a vector for complete system compromise, affecting any organization running vulnerable Grav instances for websites, portals, or content delivery platforms.

While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's extended reasoning capabilities would detect the attack chain across multiple security domains: Template Injection (CWE-1336), Code Injection patterns, and OS Command Execution. A practitioner using Casky would observe findings related to unsanitized user input flowing into template rendering engines, privilege escalation from editor to system-level execution, and the suspicious use of dangerous template filters in user-controlled fields. The platform's Claude-powered analysis would flag the critical gap between intended (formatting email fields) and actual behavior (arbitrary code execution), helping teams identify similar template injection patterns in their own applications before exploitation occurs.