CVE-2026-116019
published 2026-10-24CVE-2026-116019: Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@…
PriorityP355high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.35%
28.3th percentile
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | >= 2.0.15 < 2.2.13 | 2.2.13 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer key
ghsa_unreviewed·2026-10-24
CVE-2026-116019 [HIGH] CWE-749 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer key
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
VulDB
getgrav Grav up to 2.2.12 Flex Form Overrides privileges management
vuldb·2026-10-24·CVSS 8.8
CVE-2026-116019 [HIGH] getgrav Grav up to 2.2.12 Flex Form Overrides privileges management
A vulnerability marked as critical has been reported in getgrav Grav up to 2.2.12. This affects an unknown function of the component Flex Form Overrides. This manipulation causes improper privilege management.
This vulnerability is registered as CVE-2026-116019. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/getgrav/grav/blob/2.2.12/system/src/Grav/Common/Data/Blueprint.phphttps://github.com/getgrav/grav/commit/4d9e3935f6b79cc1a157914554ccca6066a16f87https://github.com/getgrav/grav/releases/tag/2.2.13https://github.com/getgrav/grav/security/advisories/GHSA-47gg-mh38-9rr7https://www.vulncheck.com/advisories/grav-2.0.15-before-2.2.13-allowlist-bypass-via-flex-form-override-directives
2026-10-24
Published