CVE-2026-58655 Grav Flex Objects - Server-Side Template Injection via Dynamic Titles
An attacker can achieve remote code execution by injecting Twig code into dynamic titles in the Grav Flex Objects plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58655?
CVE-2026-58655 is a high-severity code injection vulnerability in getgrav grav, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(), causing them to be evaluated as Twig code rather than treated as text. This path bypasses Grav's Security::cleanDangerousTwig() sanitization. An attacker who can control the title frontmatter of a publicly reachable Flex Objects page can achieve arbitrary Twig execution and escalate to remote command execution via access to internal Grav services such as the scheduler.
Weakness: CWE-94
Which versions are affected by CVE-2026-58655?
How do I fix CVE-2026-58655?
No fix has been published for CVE-2026-58655 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-58655 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58655 exists.
Sources
Also known as CVE-2026-61605, GHSA-623v-m3c4-3pw8, GHSA-mpq7-q5x9-rf83.