CVE-2026-109318

The Grav Git Sync plugin, versions 1.0.2 through 3.4.12 , is vulnerable to command injection when the gravuser or gravfull author modes are enabled. Authenticated content editors can execute OS commands by injecting shell substitutions into profile fields, such as username , full name , or email ...

EUVD-2026-97620

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...