CVE-2026-72819 is a remote code execution vulnerability affecting Grav CMS before version 2.0.13. The issue exists in the Flex Objects plugin's settings validation, where attackers with authentication can upload a ZIP archive containing malicious PHP code. By exploiting a bypass in the routine name validation using array notation, the attacker can invoke the unZip routine to extract and write PHP files to the web root, enabling execution of arbitrary code on the server.

Successful exploitation allows an authenticated attacker to execute arbitrary PHP code on the affected server, potentially leading to full system compromise depending on the server configuration and privileges of the web server process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent uploading of ZIP files or disable the vulnerable Flex Objects plugin if possible.