The Grav API plugin implements an API key scope enforcement flaw in the PagesController::guardTwigContent() method. The check that prevents uncontrolled Twig execution relies only on an isSuperAdmin() gate and ignores the api_key_scopes permissions token. Because an API key limited to the api.pages.write scope can still trigger the unsafe process.twig option during page save, the application performs server‑side template injection if both security.twig_content.process_enabled=true and editor_enabled=false. Consequently an attacker controlling such an API key can inject and execute arbitrary Twig code, giving full remote code execution capabilities.

The vulnerability is present in Grav versions earlier than 1.0.13. It affects the getgrav:grav product wherever the API plugin is installed and active, regardless of the site’s configuration for Page writing or administrative privileges.

With a CVSS score of 8.7 the vulnerability is high. The EPSS score is < 1% (0.00467), indicating a low but nonzero probability of exploitation, but lack of a KEV listing does not diminish the inherent severity; many exploit attempts use API tokens in automated scripts. An attacker would need to obtain or mint a super‑account API key scoped to api.pages.write, then send a page update that includes malicious Twig expressions while the page editor is disabled. The bypass is straightforward for anyone with API access, making exploitation highly likely in environments where API keys are shared or not tightly monitored.