Live › vulnerability › CVE-2026-112780
Go to dashboardA user with page-edit permission can bypass Grav's allowed-callable check by renaming a field in a page-authored Flex form with replace-name@. The renamed field is wrongly trusted as if it came from a blueprint file. The attacker can then call any public static method, such as Folder::delete, Folder::move, Folder::copy or Utils::download. That allows directory deletion, file move or overwrite, and file read outside the page tree. Grav 1.7 is not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| getgrav/grav | composer | >= 2.0.15, < 2.2.2 | 2.2.2 |
2.0.15 through 2.2.1 are vulnerable2.2.2 or later (2.2.5 also fixes later Grav CVEs)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
This page as .md · .json · in your agent: get_signal("CVE-2026-112780")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.