CVE-2026-112780 — Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with repla…
Published: 2026-10-19 · CVSS: 9.3 · CVSS 4.0
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7