CVE-2026-112780
Deferred Deferred - Pending Action

Grav CMS Allowlist Bypass via Flex Form Field Renaming

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112780
EUVD
EUVD-2026-104586

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav 2.0.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-749 The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Grav versions 2.0.15 to 2.2.1. A page editor with write permissions can rename a Flex form field using replace-name@ to bypass security checks. This allows calling arbitrary static methods like Folder::delete or Utils::download, leading to unauthorized file and directory manipulation or data theft.

Detection Guidance

Check Grav version with 'bin/grav version' or inspect composer.json for version constraints. Look for unauthorized file operations or directory deletions in logs. Review Flex form configurations for suspicious replace-name@ patterns in field names.

Impact Analysis

Attackers with page-edit access could delete directories, move or overwrite files, or read sensitive files outside the intended page tree. This could disrupt services, leak confidential data, or corrupt the Grav installation.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade Grav to version 2.2.2 or later immediately. Remove write permissions from non-admin users until patched. Audit Flex forms for replace-name@ usage and remove any suspicious configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart