---
title: "GHSA-vj3m-2g9h-vm4p: Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass"
url: https://erroneo.us/security/ghsa/GHSA-vj3m-2g9h-vm4p/
description: "GHSA-vj3m-2g9h-vm4p (critical, Composer (PHP)): Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist…"
type: advisory
section: "Security Digest"
date_published: 2026-05-05
date_modified: 2026-05-05
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-vj3m-2g9h-vm4p"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-vj3m-2g9h-vm4p: Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass

## Affected packages

- Composer (PHP) `getgrav/grav` < 2.0.0-beta.2 → fixed: 2.0.0-beta.2

## Details

Multiple RCE vectors were found in Grav CMS. Three are critical, two are high. 1. Unsafe unserialize() in JobQueue — direct RCE gadget (Critical) system/src/Grav/Common/Scheduler/JobQueue.php:465 calls unserialize(base64decode(...)) without restricting allowedclasses. The Job class has calluserfuncarray($this->command, $this->args) in its execution path, which is a direct gadget chain — inject a serialized Job with command = 'system' and args = ['whoami']. The same codebase actually has a Serializable trait that correctly restricts classes, so this inconsistency stands out. 2. Unsafe unserialize() in FileCache — arbitrary class instantiation (Critical) system/src/Grav/Framework/Cache/Adapter/FileCache.php:75 does unserialize($value, ['allowedclasses' => true]). That true allows instantiation of any class. If an attacker can write to the cache directory (via any file write primitive), they get object injection → RCE. 3. Unsafe unserialize() in Session (High) system/src/Grav/Common/Session.php:116 — same allowedclasses => true pattern on session data. Lower severity since session storage is typically more restricted. 4. Command injection in git clone (Critical) system/src/Grav/Console/Cli/InstallCommand.php:150 — only $this->destination uses escapeshellarg(). The $data['branch'], $data['url'], and $data['path'] variables go directly into the shell command without escaping. Admin-accessible via plugin/theme installation. 5. SSTI blocklist bypass (High) system/src/Grav/Common/Security.php:267-286 — cleanDangerousTwig() blocks twigarraymap and twigarrayfilter but not twigarrayreduce. Also missing filegetcontents and fwrite from the dangerous function blocklist. An attacker who can inject Twig templates can bypass the security filter. All five are independently exploitable. The unserialize issues are the most concerning since they don't require admin access if there's any file write primitive. — ProScan AppSec | proscan.one --- Maintainer note — fix applied (2026-04-24) Fixed in Grav core on the 2.0 branch: commit c66dfeb5f (items #1, #2, #3, #4) and commit 38685ac25 + c66dfeb5f (item #5) —…

## Sources

- [GitHub Advisory GHSA-vj3m-2g9h-vm4p](https://github.com/advisories/GHSA-vj3m-2g9h-vm4p)
- [github.com](https://github.com/getgrav/grav/security/advisories/GHSA-vj3m-2g9h-vm4p)
- [github.com](https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663)

---
Source page: https://erroneo.us/security/ghsa/GHSA-vj3m-2g9h-vm4p/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt