CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-56700 — Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. T...

·Source: NIST NVD

Updated:

Executive Summary

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, Install

Analysis

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2. CVSS Score: 9.8. Published: 2026-06-30T23:17:32.287.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56700
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Credit Agricole launches euro stablecoin

French bank Credit Agricole has launched a euro-denominated stablecoin and subscribed to a tokenised Amundi money market fund (MMF), in what the bank has described as a European first.

Finextra
MEDIUMVulnerabilityNEW

Pay.UK launches liquidity model for faster payments

Pay.UK, the recognised operator and standards body for the UK’s interbank retail payment systems, has gone live with a flexible model for liquidity requirements for Faster Payments Net Sender Caps (NSC), further facilitating access for a wider range of participants.

Finextra
MEDIUMVulnerabilityNEW

Unzer appoints chief product and AI officer

Unzer, a leading European provider of payment and software solutions, has appointed Isabelle Bénard as Chief Product & AI Officer (CPAIO).

Finextra