Remote Code Execution Vulnerability in Grav's Twig Sort Filter

Grav versions before 2.0.19, specifically 2.0.17 and earlier, are vulnerable to a remote code execution flaw in the Twig sort filter. The vulnerability arises from the sortFunc wrapper in GravExtension.php, which hardcodes the isSandboxed argument to false, allowing an attacker to invoke spl_autoload through the sort filter. An authenticated user with only page-write rights can exploit this by submitting a crafted payload via form frontmatter rendered by the Email plugin, leading to arbitrary PHP execution as the web server user. This vulnerability is documented as CVE-2026-85604 and was published on September 4, 2026. The attack vector is particularly concerning as it does not require elevated privileges beyond page-editing rights. The flaw has a broad impact, affecting numerous internal functions and allowing various dangerous operations. Current status indicates that the vulnerability is known and has been disclosed, but no active exploitation has been reported.

Key Points: • Grav versions <= 2.0.17 are vulnerable to remote code execution. • The vulnerability allows attackers with page-write rights to execute arbitrary PHP code. • CVE-2026-85604 was published on September 4, 2026.