CVE-2026-112780GHSA-9rq7-4cch-f22j
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
getgrav grav
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.2gravCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
Text from CVE List
Affected versions 2
- gravaffected: 2.0.15 before 2.2.2CVE List
- gravunaffected: 2.2.2CVE List