CVE-2026-109318

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109318

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109318.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109318

Aliases

GHSA-c89w-55m3-fmf7

Published

2026-10-12T16:05:11Z

Modified

2026-10-13T02:46:42Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Details

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109318.json"
}

References

Affected packages

Git / github.com/trilbymedia/grav-plugin-git-sync

Affected ranges

Type

GIT

Repo

https://github.com/trilbymedia/grav-plugin-git-sync

Events

Introduced

f8eddae94ab4dcd943fd6ad80399f16dc2cf4c49

Fixed

a524e8250eb32760fbcd2b7d51248c1f85391516

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.0.2"
        },
        {
            "fixed":  "3.4.13"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109318.json"