Grav CMS Critical Flaw Lets Editors Call Static Methods Before 2.2.2
A critical allowlist bypass in Grav versions 2.0.15 through 2.2.1 enables page editors to invoke dangerous static methods, risking file deletion and data exfiltration.
Key points
- CVE-2026-112780 affects Grav CMS versions from 2.0.15 up to but not including 2.2.2.
- The vulnerability allows authenticated page editors to bypass security checks by renaming Flex form fields.
- Attackers can trigger Folder::delete, Folder::move, or Utils::download methods to manipulate server files.
Getgrav has identified a critical security flaw in its content management system that allows page editors to invoke arbitrary public static methods. The issue, tracked as CVE-2026-112780, affects versions of Grav from 2.0.15 before 2.2.2. According to the National Vulnerability Database, this vulnerability carries a CVSS score of 9.3, classifying it as critical. The flaw stems from an allowlist bypass that fails to properly restrict method calls made by users with page-editing permissions.
What happened
The vulnerability arises from how Grav handles Flex form fields. An attacker with page-edit permissions can rename these fields using the `replace-name@` syntax. This manipulation allows the user to smuggle `data-*@` directives past the system’s callable check mechanism. Once the check is bypassed, the editor can invoke arbitrary public static methods within the application’s codebase. The NVD record specifies that this technique can trigger several high-impact functions.
Specifically, an attacker can call `Folder::delete` to remove directories from the server. They can also use `Folder::move` to overwrite existing files with malicious content. Additionally, invoking `Utils::download` allows the attacker to read and exfiltrate files from the system. These actions compromise the integrity and confidentiality of the web server hosting the Grav installation. The weakness is categorized under CWE-749, which relates to improper handling of special elements.
Why it matters
This flaw is significant because it lowers the barrier for attack. An adversary does not need administrative access to the server or the CMS backend. They only require page-editing permissions, which are often granted to content creators, marketers, or junior staff members. This broadens the potential attacker base significantly beyond system administrators. The ability to delete directories or overwrite files can lead to complete site defacement or denial of service.
Furthermore, the ability to read files via `Utils::download` poses a severe data leakage risk. Sensitive configuration files, database credentials, or user data stored on the server could be exposed. Given the high CVSS score of 9.3, this issue represents an immediate threat to any organization running affected versions of Grav. The exploit vector is straightforward, relying on standard form manipulation techniques rather than complex code injection.
What to watch
- Monitor Grav’s official release channels for the 2.2.2 update announcement.
- Review server logs for unusual `replace-name@` patterns in Flex form submissions.
- Check for unexpected file deletions or modifications in critical directories.
- Audit user permissions to ensure only necessary staff have page-edit access.
Who needs to act first
Teams managing web infrastructure should immediately inventory all servers running Grav CMS. Prioritize systems that host public-facing content or sensitive data for immediate attention. If the current version is below 2.2.2, treat the environment as compromised until verified otherwise. Begin by isolating affected instances from the public internet if possible. Test the upgrade process in a staging environment before applying it to production servers.
Ensure that backups are current and verified before initiating any changes. Restrict page-editing permissions to trusted personnel while waiting for the patch. Monitor access logs for signs of exploitation attempts, such as unusual form field names. Coordinate with development teams to validate that custom themes or plugins do not interfere with the security update.
Background: CVSS score
The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.
Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes
What to do and how to stay safe: Grav
- Verify the installed Grav version on all production and staging servers.
- If running a version prior to 2.2.2, restrict page-editing access to essential personnel only.
- Monitor server logs for suspicious activity related to Flex form field renaming.
- Prepare to upgrade to version 2.2.2 as soon as the vendor releases the patch.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Grav are affected by CVE-2026-112780?
Versions of Grav from 2.0.15 before 2.2.2 are affected by this vulnerability.
What specific actions can an attacker perform using this flaw?
An attacker can delete directories, overwrite files, or read files by invoking Folder::delete, Folder::move, or Utils::download.
Is there a fix available for this vulnerability?
Yes, upgrading to Grav version 2.2.2 resolves the issue, as the vulnerability affects versions before this release.
