CVE-2026-75574High· 8.8▾ TwilightThe Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can pl…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115223Medium· 4.9Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVE-2026-27641Critical· 9.8Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
CVE-2026-115189High· 8.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic
CVE-2026-115938High· 8.8Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
CVE-2026-55486Critical· 9.3Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
CVE-2026-96392Low· 3.5AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187