CVE-2026-56700: Grav CMS unsafe deserialization and command injection RCE

• Affected versions: Grav CMS versions before 2.0.0-beta.2. The reproduction uses 2.0.0-beta.1 as the vulnerable version and 2.0.0-beta.2 as the fixed negative control.
• Risk level and consequences: critical. If an attacker can place or tamper with a scheduler queue item and trigger scheduler processing, the queue deserialization path can instantiate a forged scheduler Job and execute arbitrary commands in the PHP/Grav process context.

Impact Parity

• Disclosed/claimed maximum impact: remote/API-triggered arbitrary code execution through unsafe deserialization in Grav components, including Scheduler\JobQueue.
• Reproduced impact from this run: code execution. The proof crafts real serialized Grav\Common\Scheduler\Job payloads whose command writes marker files, starts a real Grav web server with the real scheduler-webhook plugin, and sends POST /scheduler/webhook to trigger Scheduler::processWebhookTrigger() -> Scheduler::run() -> JobQueue::popWithId() / reconstructJob().
• Parity: full.
• Not demonstrated: the reproduction focuses on the Scheduler\JobQueue vector. It does not separately exploit the FileCache or Session::getFlashObject unsafe unserialize sinks.

Root Cause

The vulnerable JobQueue::reconstructJob() path trusted the on-disk queue item field serialized_job and directly performed:

$job = unserialize(base64_decode((string) $item['serialized_job']));

No HMAC, signature, or class restriction prevented an attacker-planted/tampered queue item from supplying a serialized Grav\Common\Scheduler\Job. The Job object has an execution path that invokes its configured command/arguments, so a forged serialized job with command system and attacker-controlled arguments becomes a direct PHP object injection to command execution primitive.

The fixed version signs the serialized job blob with an HMAC derived from Grav's nonce key and only unserializes when the sibling serialized_job_hmac verifies. Missing or mismatched HMAC values fall through to the structured queue fields instead of trusting the serialized object. The advisory identifies the fix as Grav core commit c66dfeb5f for JobQueue/FileCache/Session/InstallCommand hardening, released in 2.0.0-beta.2.

Reproduction Steps

1. Run bundle/repro/reproduction_steps.sh.
2. The script reuses/clones the real Grav repository, checks out 2.0.0-beta.1 and 2.0.0-beta.2, installs Composer dependencies, installs/enables the real scheduler-webhook plugin, starts the real PHP/Grav web server, poisons the real scheduler queue with a forged serialized_job, and sends POST /scheduler/webhook to trigger scheduler processing over HTTP.
3. Expected evidence: vulnerable 2.0.0-beta.1 creates bundle/repro/proof_vulnerable_1.txt and bundle/repro/proof_vulnerable_2.txt; fixed 2.0.0-beta.2 does not create fixed proof files and logs execution of the benign /bin/true fallback job instead.

Evidence

• Runtime manifest: bundle/repro/runtime_manifest.json records entrypoint_kind="api_remote", service_started=true, healthcheck_passed=true, and target_path_reached=true.
• Structured verdict: bundle/repro/validation_verdict.json records claim_outcome="confirmed", validated_surface="api_remote", and observed_impact_class="code_execution".
• Vulnerable proof files:
  • bundle/repro/proof_vulnerable_1.txt contains GRAV_JOBQUEUE_WEBHOOK_RCE_vulnerable_1.
  • bundle/repro/proof_vulnerable_2.txt contains GRAV_JOBQUEUE_WEBHOOK_RCE_vulnerable_2.
• Vulnerable HTTP evidence:
  • bundle/logs/vulnerable_webhook_response_1_body.json shows the webhook returned success and jobs_run: 1.
  • bundle/logs/vulnerable_scheduler_1.log and bundle/logs/vulnerable_scheduler_2.log show the forged job completed successfully with command system.
• Fixed negative control:
  • bundle/logs/fixed_scheduler_1.log and bundle/logs/fixed_scheduler_2.log show the fixed version completed the benign fallback job (/bin/true) rather than the attacker-controlled serialized Job.
  • No proof_fixed_*.txt files are produced.
• Patch-gap evidence:
  • bundle/logs/vulnerable_jobqueue_gap.log contains the vulnerable unsigned unserialize(base64_decode(...)) sink.
  • bundle/logs/fixed_jobqueue_gap.log contains the HMAC validation logic added in the fixed version.
• Environment details:
  • Grav vulnerable tag: 2.0.0-beta.1 (26a2d519c59c620e2b0a54d0baf33889d7d5db0a).
  • Grav fixed tag: 2.0.0-beta.2 (f95b0ff51a655edcbcc060a3d74b43e3f20b9585).
  • Scheduler-webhook plugin commit used for the HTTP endpoint: recorded in bundle/logs/webhook_plugin_commit.log.

Recommendations / Next Steps

• Upgrade Grav CMS to 2.0.0-beta.2 or later.
• Preserve HMAC/integrity validation for every serialized queue/cache/session payload and reject or safely rebuild unsigned legacy data rather than unserializing it.
• Prefer avoiding PHP object serialization for attacker-influenced persistent data. If serialization is unavoidable, use strict integrity checks, narrow allowed_classes, and schema-based reconstruction.
• Add regression tests that insert an unsigned/tampered queue item with a serialized Job and assert that the scheduler does not execute it.
• Review other flat-file write paths to ensure untrusted users cannot create scheduler queue, cache, or session payloads.

Additional Notes

• Idempotency confirmation: bundle/repro/reproduction_steps.sh was executed twice consecutively and produced the same vulnerable/fixed divergence both times.
• The proof uses the real Grav product, real Composer dependencies, real scheduler-webhook plugin, real local HTTP requests, and real JobQueue::reconstructJob() deserialization. It does not mock Grav classes or reimplement the sink.
• The queue-file placement models the advisory precondition for the JobQueue vector: attacker-planted or tampered queue data. The remote/API boundary is the real webhook trigger that causes the product to process that queue item.