A high-severity vulnerability in the Twig template engine within Grav CMS versions prior to 2.0.13 enables authenticated attackers to execute arbitrary code on the server.

This vulnerability (CWE-1336) arises from the improper neutralization of special elements used in the Twig template engine. Authenticated attackers can leverage this flaw to manipulate templates and execute unauthorized code within the application context.

A CVSS score of 8.8 underscores the gravity of this issue, as it grants attackers the ability to compromise the integrity and confidentiality of the entire CMS installation. Unauthorized code execution can lead to full system takeover and persistent backdoors within the web application.

Immediate Action: Update Grav CMS to version 2.0.13 or later to apply the necessary template engine security fixes.

Proactive Monitoring: Monitor template file changes and review server logs for unusual Twig engine errors or unauthorized code execution attempts.

Compensating Controls: Implement a Web Application Firewall with rules designed to detect and block malicious template injection patterns.

Public Exploit Available: Unknown.

All Grav CMS instances must be updated to version 2.0.13 to remediate this vulnerability. Given the ease of potential exploitation via template manipulation, prompt patching is essential to maintain the security posture of the web environment.