CVE-2026-112780
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors…
- Risk score
- 57/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, o…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.2.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
Last activity 19 Oct 2026. Patch Forecast updates every hour.