Grav CMS — CVE-2026-56700 (Critical)

Date Jun 30, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Grav · CMS

CVE CVE-2026-56700

Critical vendor advisory CVE-2026-56700

Summary

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin acces

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Grav CMS. Patch or mitigate promptly.

Operator check

Review CVE-2026-56700 in your asset inventory. Apply patches per vendor guidance and verify CMS is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-56700 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed