The Grav Flex Objects plugin allows page administrators to supply titles for collection or object pages via frontmatter fields. The plugin incorrectly passes these user‑controlled frontmatter values directly to Twig’s template_from_string() without sanitization, creating a stored server‑side template injection. An attacker can embed malicious Twig instructions in the title field, which the system will execute when rendering the page. The exposed Twig expressions can be leveraged to trigger Grav internal services such as the scheduler, potentially escalating to remote shell execution on the host.

Installations of getgrav/grav-plugin-flex-objects that are running any version earlier than 1.4.0 are vulnerable. The flaw is tied specifically to the handling of page.header.flex.collection.title and page.header.flex.object.title frontmatter fields used for dynamic titles.

The CVSS score of 8.7 indicates high severity, while the EPSS score of 1 % suggests a low but non‑zero probability of exploitation. Because the vulnerability is triggered by manipulating frontmatter on a publicly reachable Flex Objects page, the likely attack vector is remote via an HTTP request that updates or creates the page content. The flaw is not listed in CISA KEV at this time but the combination of high impact and the potential for remote code execution makes it an urgent security issue.