CVE-2026-7317
Remote Deserialization Vulnerability in Grav CMS Cache Component
Publication date: 2026-04-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grav | cms | to 1.7.49.5 (inc) |
| grav | cms | to 2.0.0-beta.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Grav CMS versions up to 1.7.49.5 and 2.0.0-beta.1, specifically in the FileCache::doGet function of the Cache Value Handler component. It involves manipulation that results in deserialization, which can be exploited remotely. The attack is complex and difficult to execute, but the exploit has been made public.
Upgrading to version 2.0.0-beta.2 fixes this issue.
How can this vulnerability impact me? :
Exploitation of this vulnerability could allow an attacker to perform unauthorized deserialization, potentially leading to limited confidentiality, integrity, and availability impacts on the affected system.
- Confidentiality: Low impact
- Integrity: Low impact
- Availability: Low impact
However, the attack requires a high level of complexity and is difficult to exploit.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the affected Grav CMS component to version 2.0.0-beta.2 or later, as this version addresses the issue.
The vulnerability affects the FileCache::doGet function in the Cache Value Handler component, and upgrading will apply the patch identified as c66dfeb5f.