Live › vulnerability › CVE-2026-114660
Go to dashboardGrav versions from 2.0.0 before 2.2.5 let a user with page edit rights use flex-*@ directives in page frontmatter to call arbitrary Flex object methods. When another user opens the page, those directives run in their session and can delete protected pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Grav 2.0.0 through 2.2.x before 2.2.5 where more than one account can edit pages. Single-editor sites that only admins touch carry less exposure, but the fix is the same version bump.
No product ranges from the sources yet.
2.2.52.2.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
This page as .md · .json · in your agent: get_signal("CVE-2026-114660")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.