CVE-2026-72702: Grav CMS before 2.0.16 Origin Validation Bypass via Referer
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (strstartswith($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav CMSto a version that resolves this vulnerability.Fixed in 2.0.16 - Compensating control
Mitigate the Referer-based origin validation bypass by deploying a control that does not trust Referer headers from attacker-controlled subdomains (e.g., block/deny requests where the Referer host is not exactly the victim origin) until all instances are upgraded.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to control a domain whose URL begins with the victim site's origin, such as https://example.com.attacker.tld. They can then send a request with that domain in the Referer header so it is treated as same-origin.
Which installations are affected?
Grav CMS versions before 2.0.16 are affected. The issue applies where the Uri::referrer() or Pages::referrerRoute() Referer-based origin validation is used.