CVE-2026-109318 | TrilbyMedia Grav Git Sync Plugin up to 3.4.12 Profile Fields exec gravuser/gravfull/username/full name/email os command injection

October 12, 2026 Yanac

A vulnerability has been found in TrilbyMedia Grav Git Sync Plugin up to 3.4.12 and classified as critical. Affected by this issue is the function exec of the component Profile Fields. The manipulation of the argument gravuser/gravfull/username/full name/email leads to os command injection.

This vulnerability is uniquely identified as CVE-2026-109318. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More