The vulnerability is a server‑side template injection in the translate() endpoint of grav‑plugin‑api. Attackers who can write pages through the API can inject arbitrary Twig code that is executed when the page is rendered, potentially allowing full code execution on the server. The weakness is identified as CWE‑1336, highlighting improper validation of template content.

The flaw exists in grav‑plugin‑api versions before 1.0.15 for the Grav CMS. Users running Grav CMS with the grav-plugin‑api plugin older than version 1.0.15 are impacted. Only the translate() API endpoint is vulnerable; the impact requires that the attacker has api.pages.write permission or an equivalent capability on the site.

With a CVSS score of 8.6, this flaw represents a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, yet the potential for remote code execution makes it a critical concern for exposed API endpoints. Attackers can reach the vulnerable endpoint over HTTP, and with sufficient permissions to write to pages, can persist malicious Twig templates that execute during rendering. The lack of input validation allows the injection of payloads that run server‑side and can compromise the host.