{"id":"CVE-2026-112780","kind":"vulnerability","aliases":["CVE-2026-112780"],"related":[],"title":"Grav CMS: page editors can delete, move, or read files on server","description":"Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.","summary":"A user with page-edit permission can bypass Grav's allowed-callable check by renaming a field in a page-authored Flex form with replace-name@. The renamed field is wrongly trusted as if it came from a blueprint file. The attacker can then call any public static method, such as Folder::delete, Folder::move, Folder::copy or Utils::download. That allows directory deletion, file move or overwrite, and file read outside the page tree. Grav 1.7 is not affected.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"getgrav/grav","fixed":["2.2.2"],"affected":">= 2.0.15, < 2.2.2","ecosystem":"composer"}],"ecosystems":[],"tags":["cms","flex-forms","grav","package","php","self-hosted"],"not_affected_if":["auth-required","grav-1.7","no-page-editors","unknown"],"how_to_check":"Check the Grav version (bin/grav version, or Admin > Tools > Info). Versions 2.0.15 through 2.2.1 are vulnerable. Then list accounts with api.pages.write or admin.pages permission. Those are the accounts that can exploit it.","fix":"Upgrade getgrav/grav to 2.2.2 or later (2.2.5 also fixes later Grav CVEs). Until then, limit page-edit permission to trusted users.","status":"open","published_at":"2026-10-19T20:17:55+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:53+00:00","updated_at":"2026-10-23T23:24:23+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:39:53Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Grav to 2.2.2 or later.\nunknown","reach":"internet","title":"Grav CMS: page editors can delete, move, or read files on server","impact":"high","summary":"Grav CMS versions 2.0.15 through 2.2.1 let a user with page-edit permission smuggle directives through form field names to call arbitrary public static PHP methods. The attacker can invoke Folder::delete, Folder::move, or Utils::download to delete directories, overwrite files, or read files on the server.","category":"package","who_cares":["grav","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker deletes directories, overwrites files, or reads server files","analyst_note":"Confirm the vulnerable Flex form path and whether any default install exposes page editing to low-privilege users; check the NVD page for a vendor advisory and workaround.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000491,"input_tokens":2973,"output_tokens":388,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the vulnerable Flex form path and whether any default install exposes page editing to low-privilege users; check the NVD page for a vendor advisory and workaround.","search":"'-112780':15A,18A '-2026':14A,17A '1.7':110B '2.0.15':116C '2.2.2':118C 'affect':113B 'allow':42B,95B,125C 'allowed-cal':41B 'allowlist':121C 'arbitrari':130C 'attack':75B,143C 'author':53B 'blueprint':72B 'bypass':38B,122C 'call':78B,129C 'callabl':43B,155C 'came':69B 'check':44B,156C 'cms':2A,20B 'contain':119C 'copi':90B 'cve':13A,16A 'data':151C 'delet':6A,86B,97B,160C,166C 'direct':152C 'directori':96B,167C 'download':93B,165C 'edit':35B,147C 'editor':4A,127C 'field':48B,62B,138C 'file':10A,73B,98B,103B,169C,172C 'flex':22B,54B,136C 'flex-form':21B 'folder':85B,87B,89B,159C,161C 'form':23B,55B,137C 'getgrav/grav':19A 'grav':1A,24B,39B,109B,114C 'host':29B 'invok':158C 'method':82B,133C 'move':7A,88B,99B,162C 'name':59B,142C 'outsid':105B 'overwrit':101B,168C 'packag':25B 'page':3A,34B,52B,107B,126C,146C 'page-author':51B 'page-edit':33B,145C 'past':153C 'permiss':36B,148C 'php':26B 'public':80B,131C 'read':9A,104B,171C 'renam':46B,61B,135C 'replac':58B,141C 'replace-nam':57B,140C 'self':28B 'self-host':27B 'server':12A 'smuggl':150C 'static':81B,132C 'tree':108B 'trust':65B 'user':31B 'util':92B,164C 'vulner':123C 'wrong':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112780","severity":null,"published_at":"2026-10-19T20:17:55+00:00","modified_at":"2026-10-22T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112780:434","url":null,"severity":null,"published_at":"2026-10-23T23:24:23+00:00","modified_at":"2026-10-23T23:24:23+00:00","first_seen_at":"2026-10-23T23:24:23+00:00","fetched_at":"2026-10-23T23:24:23+00:00","note":"Read vendor GHSA-9rq7-4cch-f22j (Grav 2.0.15-2.2.1, fixed 2.2.2). Needs page-edit permission (api.pages.write / admin.pages), so not default-exposed to anonymous users. No exploitation or public PoC found; no X conversation. Later Grav CVEs are fixed in 2.2.5, so moving to the latest 2.2.x is advisable."}],"documents":[{"id":1941,"url":"https://github.com/getgrav/grav/security/advisories/GHSA-9rq7-4cch-f22j","title":"GHSA-9rq7-4cch-f22j: Page editor can call arbitrary static methods through a renamed Flex form field","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1942,"url":"https://www.tenable.com/cve/CVE-2026-112780","title":"Tenable CVE-2026-112780","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}