Live › vulnerability › CVE-2026-116019
Go to dashboardGrav versions from 2.0.15 before 2.2.13 let a user with page-edit rights abuse crafted Flex form overrides in page frontmatter to invoke allowed-list-bypassed public static PHP methods. An attacker can delete directories, overwrite files, or read files outside the page tree.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Sites running Grav 2.0.15 through 2.2.12 where some users can edit pages, since the exploit uses Flex form overrides in page frontmatter. Sites where only administrators edit content are exposed to a lesser degree, and sites on versions outside this range are not affected.
No product ranges from the sources yet.
bin/grav version in the Grav install directory and compare against 2.2.13getgrav/grav version in composer.lock if installed via Composer2.2.13 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
This page as .md · .json · in your agent: get_signal("CVE-2026-116019")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.