Origin Validation Bypass in Grav CMS by GetGrav

CVE-2026-72702

What is CVE-2026-72702?

Grav CMS prior to version 2.0.16 is susceptible to an origin validation bypass due to improper handling of the Referer header in its Uri::referrer() and Pages::referrerRoute() methods. The vulnerability arises from the validation process, which employs an unanchored string prefix match without a trailing delimiter. This flaw allows an attacker with control over a malicious domain that resembles the target site’s origin, such as 'https://example.com.attacker.tld', to manipulate requests. By sending a specially crafted request using a Referer that mimics the same-origin policy, the attacker can bypass key security checks, posing a significant risk of unauthorized access and exploitation.

References