All vulnerabilities
CVE-2026-116019GHSA-47gg-mh38-9rr7

Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

getgrav grav
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.2.13Fixed versionCVE List
Published24 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 3

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.

Text from CVE List

Affected versions 1

  • gravaffected: 2.0.15 before 2.2.13CVE List

References 5