CVE-2026-114660— Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
Quick assessment
Affected
getgrav grav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grav CMS 在 2.0.0 至 2.2.5（不含 2.2.5）版本中存在一个访问控制缺陷，位于 函数中。该漏洞允许页面作者通过页面 frontmatter 中的 指令调用任意的 Flex 对象方法。当拥有页面编辑权限的用户打开该页面时，其中调用 和 的指令将在该用户的会话上下文中执行，从而导致受保护页面被删除，而这些页面原本任何账户均无权删除。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1566 · Phishing T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114660
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
Source: CVE Program / CVE List V5
Vulnerability Description
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114660
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114660
请登录查看更多情报信息。
Other References for CVE-2026-114660 (1)
Same Patch Batch · getgrav · 2026-10-22 · 4 CVEs total
| CVE-2026-114658 | 8.8 HIGH | Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite |
| CVE-2026-114659 | 6.5 MEDIUM | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes |
| CVE-2026-114657 | 5.7 MEDIUM | Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri |
IV. Related Vulnerabilities
Same product: grav
-
CVE-2026-114657
Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via -
CVE-2026-112782
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Deni -
CVE-2026-112780
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Fl -
CVE-2026-112781
Grav 2.0.0 before 2.2.2 Information Disclosure via Form conf -
CVE-2026-109326
Grav before 2.1.7 Information Disclosure via Nested .git Dir
Same vendor: getgrav
-
CVE-2026-114659
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass v -
CVE-2026-114658
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation v -
CVE-2026-114657
Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via -
CVE-2026-112782
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Deni -
CVE-2026-112781
Grav 2.0.0 before 2.2.2 Information Disclosure via Form conf
Same weakness: CWE-470
-
CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data -
CVE-2026-92206
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remo -
CVE-2026-112145
speaches-ai speaches Pyannote Diarization Model Loading pyan -
CVE-2026-71253
Apache Johnzon: ClassConverter loads & static-initializes an -
CVE-2026-111440
JDBC LogFactory 任意类加载/构造导致潜在 RCE
V. Comments for CVE-2026-114660
No comments yet