Grav before 2.0.19 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes spl_autoload through the sort filter, resulting in arbitrary PHP execution as the web server user.

Grav CMS versions up to and including 2.0.17 contain a critical remote code execution vulnerability in the Twig sort filter. The vulnerability exists because the sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, allowing the |sort filter to accept plain function names inside the sandbox. The function denylist fails to block spl_autoload, which can be used to perform a PHP include. An authenticated attacker with only page-write rights (admin.pages or api.pages.write) can exploit this by supplying a crafted payload, for example through form frontmatter rendered by the Email plugin. This results in arbitrary PHP code execution running as the web server user. The vulnerability is fixed in Grav version 2.0.19. The issue is especially concerning because it requires only low-privilege authenticated access to exploit.