CVE-2026-116019: Exposed Dangerous Method or Function in getgrav grav
Affects getgrav gravSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NWhat to do
AI-suggested
A fix is available in Grav version 2.2.13 and later. Users should upgrade to version 2.2.13 or newer to remediate this vulnerability. Until patched, restrict page-edit permissions to trusted users only.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| getgravgrav | Affected
| Fixed in
|
GitHub Actionsgravpkg:github/gravOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Grav versions from 2.0.15 up to but not including 2.2.13 contain a vulnerability that allows attackers with page-edit permissions to bypass allowlist restrictions and invoke arbitrary public static methods. This can lead to unauthorized deletion of directories, overwriting of files, or reading files outside the intended page tree by embedding crafted fields in Flex form overrides within page frontmatter.
References
- github.com/getgrav/grav/security/advisories/GHSA-47gg-mh38-9rr7 (opens in a new tab)
- github.com/getgrav/grav/commit/4d9e3935f6b79cc1a157914554ccca6066a16f87 (opens in a new tab)
- github.com/getgrav/grav/releases/tag/2.2.13 (opens in a new tab)
- github.com/getgrav/grav/blob/2.2.12/system/src/Grav/Common/Data/Blueprint.php (opens in a new tab)
- vulncheck.com/advisories/grav-2.0.15-before-2.2.13-allowlist-bypass-via-flex-form-override-directives (opens in a new tab)