CVE-2026-114660: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in getgrav grav

CVE-2026-114660 is an improper access control vulnerability in Grav CMS affecting versions >=2.0.0 and <2.2.5. The vulnerability resides in the FlexDirectory::dynamicFlexField() method, which improperly allows page authors to call arbitrary Flex object methods via specially crafted flex-*@ directives in page frontmatter. This unsafe reflection enables execution of methods such as setStorageKey() and delete() when a user with page edit rights opens the page, leading to unauthorized deletion of protected pages.

An attacker with page authoring privileges can craft page frontmatter directives that cause arbitrary Flex object methods to be executed in the context of users with page edit rights. This can result in deletion of protected pages that neither the attacker nor the victim user should be able to delete, leading to potential data loss and content disruption. The vulnerability requires user interaction (opening the page) and privileges to edit pages, limiting but not eliminating risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict page authoring permissions to trusted users only and avoid opening pages from untrusted authors. Monitor vendor communications for updates on patches or official fixes.