A template injection flaw within the Grav Email plugin enables authenticated attackers to perform remote code execution, necessitating an immediate update.

This vulnerability (CWE-1336) involves improper neutralization of special elements within the Twig template engine. An attacker with low-level privileges (PR:L) can manipulate template processing to execute unauthorized commands on the server.

The ability to execute arbitrary code on the server represents a critical security failure, potentially leading to full system compromise, data theft, or complete service disruption. With a CVSS score of 8.8, this high-severity vulnerability allows an authenticated attacker to move beyond application-level access to the underlying operating system environment.

Immediate Action: Update the Grav Email plugin to version 4.2.2 or later to address the template injection flaw.

Proactive Monitoring: Inspect server logs for anomalous execution patterns or unexpected system calls originating from the web application process.

Compensating Controls: Ensure that the application is running with the principle of least privilege, limiting the permissions of the web server user to minimize the potential impact of a successful code execution.

Public Exploit Available: false

Given the potential for remote code execution, this issue requires immediate attention from security teams. Organizations should verify their current version of the Grav Email plugin and apply the 4.2.2 update to prevent unauthorized code execution.