CVE-2026-85604

    Dashboard / Vulnerabilities / CVE-2026-85604

    CVE-2026-85604

    Published: 4 Sept 2026Last Modified: 10 Sept 2026

    Summary: Grav before 2.0.18 Remote Code Execution via sort filter

    Details: Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes spl_autoload through the sort filter, resulting in arbitrary PHP execution as the web server user.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85604.json, https://github.com/getgrav/grav/security/advisories/GHSA-p6qj-p5m7-f62h, https://nvd.nist.gov/vuln/detail/CVE-2026-85604, https://www.vulncheck.com/advisories/grav-before-2.0.19-remote-code-execution-via-sort-filter

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a18854ab74f00161220e9391f9a8682a1ebf07ac

    Affected versions

    2.0.17
    2.0.16
    2.0.15
    2.0.14
    2.0.13
    2.0.12
    2.0.11
    2.0.10
    2.0.9
    2.0.8
    2.0.7
    2.0.6
    2.0.5
    2.0.4
    2.0.3
    2.0.2
    2.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85604 | CVE-DB