CVE-2026-114660 Details

An improper access control vulnerability has been identified in Grav versions 2.0.0 prior to 2.2.5. The issue resides in the FlexDirectory::dynamicFlexField() method, where page authors can invoke arbitrary Flex object methods through flex-*@ directives in the page frontmatter. When a user with editing privileges accesses the page, the directives execute in their session, potentially calling methods like setStorageKey() and delete(). This exploitation can lead to the deletion of protected pages that neither the author nor the editor is permitted to remove.

Users can upgrade to Grav version 2.2.5, where this vulnerability has been fixed. In the patched version, flex-*@ directives in page frontmatter can only check the existence of the referenced object, without the ability to invoke methods. Instructions for updating Grav can be found in the official Grav documentation.