Threats tagged 'ghsa-gwfr-jfjf-92vv'

CVE-2026-7317 is an insecure deserialization vulnerability in the Grav CMS FileCache component affecting versions from 1.7.44 up to but not including 2.0.0-beta.2. The vulnerability arises because the cache deserialization uses PHP's unserialize with 'allowed_classes' set to true, allowing object instantiation without restriction. This can lead to execution of object magic methods if an attacker can tamper with cache files. A fix was applied in Grav 2.0.0-beta.2, introducing HMAC signing and verification of cache payloads to prevent tampering.