Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112780— Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Quick assessment

Affected
getgrav grav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grav CMS 在 2.0.15 至 2.2.2 版本（不含 2.2.2）中存在白名单绕过漏洞。该漏洞允许拥有页面编辑权限的攻击者，通过将 Flex 表单字段重命名为 ，从而调用任意公开静态方法。攻击者可借此绕过可调用性检查，注入 指令，进而调用 、 或 方法，实现删除目录、覆盖文件或读取文件等操作。

CVSS 8.8 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
getgrav grav 2.0.15< 2.2.2 affected
2.2.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112780

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
Source: CVE Program / CVE List V5
Vulnerability Description
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
暴露危险的方法或函数
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getgrav grav 2.0.15 ~ 2.2.2 -

II. Public POCs for CVE-2026-112780

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112780

请登录查看更多情报信息。

Other References for CVE-2026-112780 (2)

Same Patch Batch · getgrav · 2026-10-19 · 4 CVEs total

CVE-2026-112779 9.8 CRITICAL Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
CVE-2026-112782 7.5 HIGH Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
CVE-2026-112781 6.5 MEDIUM Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

IV. Related Vulnerabilities

Same product: grav
Same vendor: getgrav
Same weakness: CWE-749

V. Comments for CVE-2026-112780

No comments yet

Leave a comment