Allowlist Bypass Vulnerability in Grav Product by GetGrav
CVE-2026-116019

8.7HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
24 October 2026

What is CVE-2026-116019?

Grav versions 2.0.15 through 2.2.12 are susceptible to an allowlist bypass vulnerability. This issue allows page editors, by exploiting improperly configured directives, to invoke arbitrary public static methods. By manipulating the Flex form override fields in page frontmatter, an attacker with page-edit permissions could execute methods such as Folder::delete or Utils::download. This could lead to unauthorized actions, including deleting directories, overwriting files, and reading files outside the intended page tree.

Affected Version(s)

grav 2.0.15 < 2.2.13

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://github.com/getgrav/grav/commit/4d9e3935f6b79cc1a1...
patch
https://github.com/getgrav/grav/releases/tag/2.2.13
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jesus Ramon Padilla Soqui
.