The vulnerability is a command injection flaw that lets authenticated content editors inject shell substitutions into the author information of Git commits. When the gravuser or gravfull author mode is enabled, malicious values for the username, full name, or email are passed to PHP exec() via git commit --author, allowing the attacker to run arbitrary OS commands as the web-server process. This results in full compromise of the affected server for any user with editor privileges.

The flaw affects Grav Git Sync plugin versions 1.0.2 through 3.4.12 for the trilbymedia:grav-plugin-git-sync vendor. No specific patch versions are listed in the data, but users must upgrade beyond 3.4.12 to mitigate.

The CVSS score of 8.7 indicates high severity, while the EPSS score is 1%, meaning there is a low but non-zero exploitation probability. The vulnerability is not in the CISA KEV catalog. Attackers need authenticated editor access; the attack vector is local to the web application. Successful exploitation would grant the attacker the same permissions as the web-server process and lead to remote code execution on the server.