Stored Twig injection via omitted content guards

Server-side template injection in Grav API Plugin before 1.0.15 allows remote authenticated users to execute Twig code via translate requests. PagesController::translate() writes caller-supplied header and content into a new translated page and saves it without calling guardTwigContent() or validatePageChanges(), so process.twig can be enabled on attacker-controlled content and later rendered. Exploitation requires api.pages.write permission and a deployment where Twig content processing is enabled but editor-side enabling is blocked; the immediate result is stored, sandboxed template execution at render time, with full code execution only if a separate Twig sandbox escape is also present.