CVE-2026-109318

Executive Summary

Grav Git Sync versions 1.0.2 through 3.4.12 contain an OS command injection vulnerability (CWE-78) that allows authenticated content editors to execute arbitrary operating system commands on the underlying web server. The flaw is exploitable when the gravuser or gravfull author mode is enabled, as attacker-controlled values from profile fields (username, full name, or email) are passed unsanitized to PHP's exec() function via the git commit --author argument. With a CVSS score of 8.8 (High), successful exploitation grants command execution in the context of the web-server account, potentially leading to full server compromise.

Technical Analysis

The vulnerability resides in the Grav Git Sync plugin's handling of Git author metadata. When the plugin is configured with either the gravuser or gravfull author mode, it constructs a git commit --author command using values drawn from the authenticated user's profile fields. These fields include the username, full name, and email address associated with the content editor's account.

The core issue is that these profile field values are not sanitized or escaped before being concatenated into the shell command string passed to PHP's exec() function. PHP's exec() invokes a system shell (typically /bin/sh on Unix-like systems), which interprets shell metacharacters. An attacker who can set a malicious value in any of these profile fields — for example, a username containing shell substitution syntax such as backticks or $() — can cause the shell to evaluate the injected content as a command when a Git commit is triggered by the plugin.

The attack surface is the authenticated content editor profile. The vulnerability requires that the Git Sync plugin is active and configured with one of the two vulnerable author modes (gravuser or gravfull). Both conditions are operational configurations, not default states, meaning the attack requires a specific but plausible deployment posture.

The injection reaches exec() through the git commit --author argument. Because the injected value is placed inside a shell-interpreted context rather than a properly quoted argument, standard shell substitution mechanisms (command substitution, backtick expansion) are available to the attacker. This allows arbitrary command execution with the privileges of the web-server process (e.g., www-data, apache, nginx).

No public proof-of-concept, Nuclei template, or exploit code is available for this vulnerability. The attack mechanism described above is derived strictly from the NVD description and represents the vulnerability class behavior; no specific function names, file paths, or parameter names beyond those in the description are asserted.

Exploitation Scenarios

Step 1 — Reconnaissance and target identification: An attacker identifies a target running Grav CMS with the Git Sync plugin. This can be accomplished through Shodan searches for Grav-specific HTML artifacts, version fingerprinting via the Grav admin interface, or by observing Git-related behavior (commit metadata) in publicly accessible repositories synchronized by the plugin. The attacker must determine whether the gravuser or gravfull author mode is enabled, which may be inferable from observed commit author strings or through authenticated access to the plugin configuration.

Step 2 — Triggering the vulnerability class: The attacker must possess valid credentials for a content editor account. Using the Grav admin interface, the attacker navigates to their profile settings and sets a malicious value in one of the profile fields: username, full name, or email. This value contains shell substitution syntax — for example, a command substitution expression would be embedded in the field. Because the application does not sanitize or escape this input before use, the malicious payload is stored and later incorporated into the Git command.

Step 3 — Payload execution: When the Git Sync plugin next performs a commit operation (triggered by content save, scheduled sync, or administrative action), it constructs the git commit --author command using the stored profile field values and passes the resulting string to PHP's exec(). The shell interprets the embedded substitution syntax, executing the attacker's injected command. The command runs as the web-server account.

Step 4 — Post-exploitation impact: Successful command execution allows the attacker to read sensitive files (configuration, credentials), write webshells, pivot to other internal systems, exfiltrate data, or establish persistence. Because the web-server account often has read access to application configuration and potentially database credentials, the blast radius can extend well beyond the Grav installation.

No public PoC is available; the attack chain above is inferred from the vulnerability class (OS command injection via unsanitized input to exec()) and the specific vector described in the NVD entry.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 8.8 (High).

• Attack Vector (AV:N): Exploitation is possible over the network via the web interface.
• Attack Complexity (AC:L): No special conditions beyond authenticated access and the vulnerable configuration; the attack is straightforward.
• Privileges Required (PR:L): The attacker needs a content editor account, which is a low-privilege role.
• User Interaction (UI:N): No victim interaction is required beyond the attacker's own actions.
• Scope (S:U): The vulnerable component and impacted component are the same — the web server.
• Confidentiality (C:H): Full read access to server files and data within the web-server account's reach.
• Integrity (I:H): Ability to modify files, inject code, and alter system state.
• Availability (A:H): Potential to disrupt services, delete files, or consume resources.

Business impact: Any organization running Grav CMS with the Git Sync plugin and author mode gravuser or gravfull is affected. The vulnerability allows a low-privileged authenticated user (content editor) to escalate to OS command execution as the web-server account. This can lead to full server compromise, data breach, lateral movement, and persistent backdoor installation. The absence of a patch increases risk for long-term exposure.

Detection Guidance

Sigma Rule

title: Grav Git Sync Command Injection via Profile Fields
id: 8f2c1a4e-3b7d-4e9a-9c1f-6d2e8a7b5c3f
status: experimental
description: Detects potential command injection through Grav Git Sync plugin when malicious profile fields are used in git commit --author
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-109318
author: SOC Team
date: 2026/05/20
tags:
    - attack.t1059
    - attack.execution
logsource:
    category: process_creation
    product: linux
detection:
    selection_git:
        Image|endswith: '/git'
        CommandLine|contains: 'commit'
    selection_author:
        CommandLine|contains: '--author'
    selection_suspicious:
        CommandLine|contains:
            - '`'
            - '$('
            - ';'
            - '|'
            - '&&'
            - '/bin/sh'
            - '/bin/bash'
    condition: selection_git and selection_author and selection_suspicious
falsepositives:
    - Legitimate author names containing special characters
level: high

YARA Rule

rule CVE_2026_109318_Grav_Git_Sync_Command_Injection
{
    meta:
        description = "Detects command injection payloads targeting Grav Git Sync git commit --author"
        author = "SOC Team"
        date = "2026-05-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109318"
        severity = "high"

    strings:
        $git_author = "git commit --author" ascii nocase
        $gravuser = "gravuser" ascii nocase
        $gravfull = "gravfull" ascii nocase
        $shell_sub1 = "$(" ascii
        $shell_sub2 = "`" ascii
        $exec_call = "exec(" ascii nocase
        $git_sync = "git-sync" ascii nocase

    condition:
        (uint16(0) == 0x3c3f or uint32(0) == 0x702e7068) and
        (
            ($git_author and any of ($shell_sub*)) or
            ($git_sync and any of ($shell_sub*) and any of ($gravuser, $gravfull)) or
            ($exec_call and $git_author and any of ($shell_sub*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109318 Grav Git Sync Command Injection Attempt via Profile Field"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin"; nocase; http.request_body; content:"gravuser"; nocase; http.request_body; content:"$("; distance:0; http.request_body; content:"--author"; nocase; distance:0; reference:cve,2026-109318; classtype:attempted-admin; sid:2026109318; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "git" and
  process.args : "*commit*" and
  process.args : "*--author*" and
  (
    process.args : "*$(*" or
    process.args : "*`*" or
    process.args : "*;*" or
    process.args : "*|*" or
    process.args : "*&&*"
  )

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=sysmon_linux
| search process_name="git" AND process_command="*commit*" AND process_command="*--author*"
| regex process_command="[\`\$]\(|;|\||&&"
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_command, user
| where count > 0

Wazuh OSSEC Rule

<group name="grav,web,command_injection,">
  <rule id="109318" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">git</field>
    <field name="process.args">commit</field>
    <field name="process.args">--author</field>
    <regex field="process.args">[\`\$]\(|;|\||&&</regex>
    <description>CVE-2026-109318: Grav Git Sync command injection via git commit --author</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>attack,execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations:

• Disable the Git Sync plugin if it is not operationally required.
• If the plugin must remain active, change the author mode from gravuser or gravfull to a mode that does not use user-controlled profile fields (e.g., a static or non-user-derived author string).
• Restrict content editor accounts to trusted personnel only; audit all existing accounts with editor privileges.
• Implement a Web Application Firewall (WAF) rule to detect and block shell metacharacters ($(), backticks, ;, |, &&) in requests to the Grav admin profile endpoints.
• Run the web server under a least-privilege account with no shell access (e.g., /usr/sbin/nologin) to limit the impact of command execution.
• Segment the web server from sensitive internal networks to reduce lateral movement risk.

2) Patch/upgrade steps:

• No vendor patch is currently available. Monitor the Grav Git Sync plugin repository for security updates.
• Once a patched version is released, upgrade immediately to the fixed version.
• If a patch is not forthcoming, evaluate alternatives to the Git Sync plugin for Git-based content synchronization.

3) Long-term hardening:

• Implement input validation and output encoding for all profile fields, particularly those that may be used in system command contexts.
• Adopt a secure coding standard that prohibits passing user-controlled data to shell functions such as exec(), shell_exec(), system(), or passthru(). Use PHP's escapeshellarg() and escapeshellcmd() where unavoidable.
• Enforce multi-factor authentication for all administrative and editor accounts.
• Conduct regular security audits of plugins that interact with the operating system or external binaries.
• Deploy runtime application self-protection (RASP) or host-based intrusion detection to detect anomalous command execution.
• Maintain a software bill of materials (SBOM) to rapidly identify affected instances when vulnerabilities are disclosed.

References

1. NVD — CVE-2026-109318: https://nvd.nist.gov/vuln/detail/CVE-2026-109318
2. MITRE CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
3. MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
4. Grav Git Sync Plugin Repository: https://github.com/getgrav/grav-plugin-git-sync (returned 404 — verify manually)
5. FIRST EPSS — CVE-2026-109318: Not yet scored (https://api.first.org/data/v1/epss?cve=CVE-2026-109318)