What is GHSA-2jqg-x237-hwx2?

GHSA-2jqg-x237-hwx2 is a security advisory published by GitHub Security Advisories with High severity. grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint,...

Which CVE IDs does GHSA-2jqg-x237-hwx2 cover?

GHSA-2jqg-x237-hwx2 covers the following CVE IDs: CVE-2026-75829. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2jqg-x237-hwx2?

GHSA-2jqg-x237-hwx2 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-2jqg-x237-hwx2HighCVSS 8.1

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint,...

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-75829 →

📋 Description

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-w94c-jmg4-w4c9
https://nvd.nist.gov/vuln/detail/CVE-2026-75829
https://www.vulncheck.com/advisories/grav-plugin-api-before-twig-ssti-via-translate-endpoint
https://github.com/advisories/GHSA-2jqg-x237-hwx2