CVE-2026-112780 Details
Description
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
An allowlist bypass vulnerability has been identified in Grav versions 2.0.15 prior to 2.2.2. This vulnerability allows page editors to invoke arbitrary public static methods by renaming Flex form fields with 'replace-name@'. Attackers with page-edit permission can bypass the callable check for 'data-*@' directives, enabling them to execute methods such as 'Folder::delete', 'Folder::move', or 'Utils::download'. Exploitation of this vulnerability could result in unauthorized deletion of directories, overwriting of files, or unauthorized reading of files.
Users can upgrade to Grav version 2.2.2, where this vulnerability has been fixed. In the patched version, 'replace-name@' is removed from untrusted blueprint input before it is merged, ensuring that page-authored fields retain their untrusted origin.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-9rq7-4cch-f22j | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/grav-2.0.15-before-2.2.2-arbitrary-static-method-call-via-flex-form-replace-name | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 2.0.15, < 2.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |