{"id":"CVE-2026-116019","kind":"vulnerability","aliases":["CVE-2026-116019"],"related":[],"title":"Grav CMS: page editors can call arbitrary PHP methods, delete or read files","description":"Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.","summary":"Grav versions from 2.0.15 before 2.2.13 let a user with page-edit rights abuse crafted Flex form overrides in page frontmatter to invoke allowed-list-bypassed public static PHP methods. An attacker can delete directories, overwrite files, or read files outside the page tree.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","grav","package","php","self-hosted"],"not_affected_if":["default-config","single-editor-only"],"how_to_check":"- Run `bin/grav version` in the Grav install directory and compare against `2.2.13`\n- Check the `getgrav/grav` version in `composer.lock` if installed via Composer\n- Review which accounts hold page-edit permissions in the admin panel","fix":"- Upgrade Grav to `2.2.13` or later\n- Limit page-edit permissions to trusted editors until upgraded","status":"open","published_at":"2026-10-24T12:16:58+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","triaged_at":"2026-10-25T02:59:53+00:00","updated_at":"2026-10-25T02:59:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T02:59:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Grav to `2.2.13` or later\n- Limit page-edit permissions to trusted editors until upgraded","reach":"internet","title":"Grav CMS: page editors can call arbitrary PHP methods, delete or read files","impact":"high","summary":"Grav versions from 2.0.15 before 2.2.13 let a user with page-edit rights abuse crafted Flex form overrides in page frontmatter to invoke allowed-list-bypassed public static PHP methods. An attacker can delete directories, overwrite files, or read files outside the page tree.","category":"package","nicknames":[],"who_cares":["grav","php","self-hosted","cms"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker deletes directories, overwrites files, or reads files outside the page tree","analyst_note":"Confirm the exact affected version range and whether a patch commit or advisory from the Grav project exists to verify the fix version.","how_to_check":"- Run `bin/grav version` in the Grav install directory and compare against `2.2.13`\n- Check the `getgrav/grav` version in `composer.lock` if installed via Composer\n- Review which accounts hold page-edit permissions in the admin panel","needs_analyst":true,"not_affected_if":["default-config","single-editor-only"],"who_is_affected":"Sites running Grav 2.0.15 through 2.2.12 where some users can edit pages, since the exploit uses Flex form overrides in page frontmatter. Sites where only administrators edit content are exposed to a lesser degree, and sites on versions outside this range are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":3379,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116019':16A,19A '-2026':15A,18A '2.0.15':30B,74C '2.2.13':32B,76C 'abus':41B 'allow':52B,83C 'allowed-list-bypass':51B 'allowlist':79C 'arbitrari':7A,88C 'attack':60B,103C 'bypass':54B,80C 'call':6A,121C 'cms':2A,20B 'contain':77C 'craft':42B,111C 'cve':14A,17A 'data':94C 'delet':10A,62B,125C,129C 'direct':95C 'directori':63B,130C 'download':128C 'edit':39B,107C 'editor':4A,85C 'emb':110C 'field':112C 'file':13A,65B,68B,132C,135C 'flex':43B,114C 'folder':124C 'form':44B,115C 'frontmatt':48B,119C 'grav':1A,21B,27B,73C 'host':26B 'integ':101C 'invok':50B,87C 'key':102C 'let':33B 'like':123C 'list':53B 'method':9A,58B,91C,122C 'name':99C 'outsid':69B,136C 'overrid':45B,116C 'overwrit':64B,131C 'packag':22B 'page':3A,38B,47B,71B,84C,106C,118C,138C 'page-edit':37B,105C 'permiss':108C 'php':8A,23B,57B 'public':55B,89C 'read':12A,67B,134C 'reloc':93C 'right':40B 'self':25B 'self-host':24B 'static':56B,90C 'tree':72B,139C 'unset':98C 'unset-nam':97C 'user':35B 'util':127C 'version':28B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running Grav 2.0.15 through 2.2.12 where some users can edit pages, since the exploit uses Flex form overrides in page frontmatter. Sites where only administrators edit content are exposed to a lesser degree, and sites on versions outside this range are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T12:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116019","severity":null,"published_at":"2026-10-24T12:16:58+00:00","modified_at":"2026-10-24T12:16:58+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","fetched_at":"2026-10-24T12:47:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}