CVE-2026-116019 in Grav
Summary
by MITRE • 10/24/2026
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in Grav versions prior to 2.2.13 represents a critical security flaw rooted in improper validation of input data within the Flex Forms system. Specifically, this is an allowlist bypass vulnerability that permits attackers with page-editing permissions to execute arbitrary public static methods on PHP classes associated with the CMS. The core technical issue lies in how Grav processes configuration directives embedded in page frontmatter. While the application attempts to restrict method calls through a whitelist of allowed actions and parameters, it fails to adequately sanitize or validate keys within data attributes that utilize specific naming conventions such as unset-name@ or integer-based keys. By manipulating these structural elements, an attacker can effectively bypass the intended restrictions on which methods are callable, thereby gaining unauthorized access to internal functionality that should remain inaccessible through standard user interfaces.
From a technical perspective, this flaw allows for Remote Code Execution (RCE) scenarios where the impact is determined by the specific method invoked via the crafted Flex form override. The vulnerability enables the invocation of sensitive static methods such as Folder::delete and Utils::download. When an attacker triggers Folder::delete through this bypass mechanism, they can delete arbitrary directories within the file system structure managed by Grav, leading to a complete denial of service for affected sites or the destruction of critical configuration files. Conversely, invoking Utils::download allows for unauthorized file access, enabling attackers to read and exfiltrate sensitive data located outside the designated page tree boundaries. This capability effectively breaks the isolation model intended by the CMS architecture, allowing lateral movement within the server environment if further exploitation vectors exist in conjunction with this initial foothold.
The operational impact of this vulnerability is severe for any organization running Grav 2.0.15 through 2.2.12 where users possess page-editing privileges. Since many content management systems rely on a role-based access control model, the assumption that editors can only modify visible content is violated here. An attacker with legitimate but limited credentials can escalate their privilege level by exploiting this logic error to perform administrative actions such as file deletion and unauthorized data retrieval. This undermines the integrity of the web application and potentially exposes sensitive backend information or configuration details that could facilitate further attacks against the underlying infrastructure. The ability to delete directories also poses a significant risk to availability, allowing for destructive actions that require manual restoration from backups if no automated recovery mechanisms are in place.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and specifically relates to CWE-20 Improvement of Error Handling by ensuring proper input validation against expected formats and values. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter where an attacker uses system utilities or scripts to execute commands, as well as T1083 File and Directory Discovery for locating sensitive files via Utils::download. To mitigate this risk, administrators must upgrade Grav to version 2.2.13 or later immediately upon availability. Additionally, until the patch is applied, it is advisable to restrict page-editing permissions to trusted users only and monitor server logs for unusual patterns of file access or deletion operations that deviate from normal content editing workflows. Implementing strict input validation at the application layer and employing Web Application Firewalls with rules targeting specific Flex form manipulation attempts can provide an additional layer of defense against exploitation of this allowlist bypass technique.