Grav Git Sync: OS command injection via commit author
Summary
Grav Git Sync, a plugin for the Grav flat-file CMS, builds Git commands as shell strings and inserts profile values into the commit author without proper escaping. An authenticated content editor can set a malicious username, full name or email that is executed as an operating system command when a synchronized change is committed. Exploitation requires the administrator to have selected the gravuser or gravfull author mode; the default mode is not affected through this path.
Affected
- Grav Git Sync (trilbymedia/grav-plugin-git-sync) 1.0.2 through 3.4.12
- Only sites using the gravuser or gravfull author mode are exposed through this path
Fixed in
- Git Sync 3.4.13 (according to the vendor advisory; release not yet independently verified)
Workaround
- Switch the author setting back to the default gituser mode, if this is acceptable for commit attribution. Test first.
- Restrict editor accounts to trusted staff and review their profile fields.
- Unknown: no official workaround is published by the vendor.
Exploitation
- CISA-ADP (Vulnrichment) lists exploitation as none; not in CISA KEV.
- EPSS is 1.2 percent.
- No public proof of concept found in the research; this does not prove none exists.
Our recommendation
- Check whether Git Sync is installed and which version and author mode it uses.
- If author mode is gravuser or gravfull, switch to the default or restrict editor access now.
- Upgrade to Git Sync 3.4.13 once the release is confirmed.
- Review editor accounts and whether the admin panel is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-c89w-55m3-fmf7 github.com
- VulnCheck advisory: Grav Git Sync command injection via commit author www.vulncheck.com
- OpenCVE CVE-2026-109318 app.opencve.io
- OSV CVE-2026-109318 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:47.
Original description (NVD)
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.