CVE-2026-112780

8.8High

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-749

Impact

Authenticated page editors can delete directories, overwrite files, or read arbitrary files on the server. They need an active account with page-edit privileges.

Root cause

An allowlist check bypass allows renaming Flex form fields with replace-name@ to invoke arbitrary public static methods.

Affected systems

Grav 2.0.15 before 2.2.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Grav to version 2.2.2 or later. If you cannot patch immediately, revoke page-edit privileges from untrusted accounts.

shell

$ bin/gpm selfupgrade -f

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112780