CVE-2026-116019: Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs page-edit permission in Grav. They can place crafted fields in Flex form overrides within page frontmatter; no user interaction is required.
What impact could successful exploitation have?
A page editor may invoke arbitrary public static methods, including methods such as Folder::delete or Utils::download. This can enable deletion of directories, file overwrites, or reading files outside the page tree.
Which versions are affected?
Grav versions from 2.0.15 before 2.2.13 are affected. Version 2.2.13 is identified as the release containing the fix.