Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109318— Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Quick assessment

Affected
trilbymedia grav-plugin-git-sync
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grav Git Sync 1.0.2 至 3.4.12 版本存在命令注入漏洞，允许经过身份验证的内容编辑者通过在个人资料字段中注入 Shell 替换命令，执行操作系统命令。当启用了 gravuser 或 gravfull 作者模式时，攻击者可设置恶意的用户名、全名或电子邮件地址，这些值会通过 git commit --author 参数传入 PHP 的 exec() 函数，从而以 Web 服务器用户的身份执行任意命令。

CVSS 8.8 · High EPSS 1.22% · P68

Affected Version Matrix 2

VendorProduct Version RangeStatus
trilbymedia grav-plugin-git-sync 1.0.2< 3.4.13 affected
3.4.13 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109318

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author
Source: CVE Program / CVE List V5
Vulnerability Description
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
trilbymedia grav-plugin-git-sync 1.0.2 ~ 3.4.13 -

II. Public POCs for CVE-2026-109318

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109318

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109318 (1)

News Coverage for CVE-2026-109318 (1)

IV. Related Vulnerabilities

Same weakness: CWE-78

V. Comments for CVE-2026-109318

No comments yet

Leave a comment