CVE-2026-56700: Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection

Synopsis

Multiple remote code execution vulnerabilities affect Grav CMS before version 2.0.0-beta.2, including unsafe PHP deserialization in three components (Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session), an OS command injection flaw in the InstallCommand git clone operation, and a Twig server-side template injection bypass. The deserialization paths are reachable over the network with no authentication required, and successful exploitation gives an attacker arbitrary code execution on the host. A patched-image rebuild at 2.0.0-beta.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization endpoints are exposed over the network, so an attacker must be able to reach the service via HTTP/HTTPS to deliver a malicious payload.

• AuthenticationNot required

  The deserialization vulnerabilities require no credentials; the command injection via InstallCommand does require admin access, but the primary RCE paths are unauthenticated.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends a crafted request directly to the application.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• Executes arbitrary OS commands or PHP code under the web server process, giving the attacker a foothold on the host.
• Reads any file accessible to the web server user, including application secrets, database credentials, and session data.
• Writes or overwrites files on the server, enabling persistent backdoors or defacement of served content.
• Crashes or disrupts the Grav application and any co-located services sharing the same container or process namespace.