CVE-2026-7317 Details
Description
A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.
A vulnerability exists in Grav CMS versions 1.7.44 through 1.7.49.5 and in 2.0.0-beta.1. The issue arises in the FileCache component, specifically within the doGet method, which deserializes cache values with 'allowed_classes' set to true. This behavior permits arbitrary object instantiation when cache files are manipulated by an attacker. The vulnerability can be exploited remotely, but doing so requires a high level of complexity and appears to be challenging.
Upgrade Grav CMS to version 2.0.0-beta.2, which addresses the vulnerability by adding HMAC integrity to the FileCache component. The update ensures that cache payloads are signed and verified, preventing the exploitation of deserialization vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 28, 2026CISA-ADP
Assessed Apr 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection | [email protected] | Exploit |
| https://github.com/getgrav/grav/commit/c66dfeb5f | [email protected] | Source CodeVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv | [email protected] | AdvisoryExploitRemedyVendor |
| https://vuldb.com/submit/798732 | [email protected] | Permission Required |
| https://vuldb.com/vuln/359965 | [email protected] | AdvisoryPermission RequiredRemedy |
| https://vuldb.com/vuln/359965/cti | [email protected] | Permission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 1.7.44, <= 1.7.49.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 28, 2026 | New CVE Received | [email protected] |