---
id: "CVE-2026-112780"
kind: "vulnerability"
aliases: ["CVE-2026-112780"]
title: "Grav CMS: page editors can delete, move, or read files on server"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "getgrav/grav", "fixed": ["2.2.2"], "affected": ">= 2.0.15, < 2.2.2", "ecosystem": "composer"}]
ecosystems: []
tags: ["cms", "flex-forms", "grav", "package", "php", "self-hosted"]
not_affected_if: ["auth-required", "grav-1.7", "no-page-editors", "unknown"]
published_at: "2026-10-19T20:17:55+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T23:24:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112780", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:24:23+00:00"}]
---

# Grav CMS: page editors can delete, move, or read files on server

A user with page-edit permission can bypass Grav's allowed-callable check by renaming a field in a page-authored Flex form with replace-name@. The renamed field is wrongly trusted as if it came from a blueprint file. The attacker can then call any public static method, such as Folder::delete, Folder::move, Folder::copy or Utils::download. That allows directory deletion, file move or overwrite, and file read outside the page tree. Grav 1.7 is not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:getgrav/grav affected >= 2.0.15, < 2.2.2 fixed 2.2.2

## How to check

Check the Grav version (bin/grav version, or Admin > Tools > Info). Versions 2.0.15 through 2.2.1 are vulnerable. Then list accounts with api.pages.write or admin.pages permission. Those are the accounts that can exploit it.

## Fix

Upgrade getgrav/grav to 2.2.2 or later (2.2.5 also fixes later Grav CVEs). Until then, limit page-edit permission to trusted users.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112780
- 2026-10-23T23:24:23+00:00 analyst — Read vendor GHSA-9rq7-4cch-f22j (Grav 2.0.15-2.2.1, fixed 2.2.2). Needs page-edit permission (api.pages.write / admin.pages), so not default-exposed to anonymous users. No exploitation or public PoC found; no X conversation. Later Grav CVEs are fixed in 2.2.5, so moving to the latest 2.2.x is advisable.

## Documents

- [advisory] GHSA-9rq7-4cch-f22j: Page editor can call arbitrary static methods through a renamed Flex form field https://github.com/getgrav/grav/security/advisories/GHSA-9rq7-4cch-f22j
- [mentions] Tenable CVE-2026-112780 https://www.tenable.com/cve/CVE-2026-112780

## From the sources

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_