Grav Allowlist Bypass Vulnerability

Grav versions 2.0.15 through 2.2.1 contain an allowlist bypass vulnerability (CVE-2026-112780) within the Flex form processing logic. This vulnerability allows an authenticated user with page-edit permissions to manipulate form fields by leveraging the 'replace-name@' syntax. By smuggling 'data-*@' directives past the application's internal callable check, an attacker can invoke unauthorized public static methods. Exploitation of this vulnerability grants the attacker the ability to perform sensitive file system operations, including the deletion of directories via 'Folder::delete', the movement of files via 'Folder::move', or unauthorized file reads through 'Utils::download'. This vulnerability poses a significant risk to the integrity and confidentiality of the CMS installation.

Impact

Successful exploitation allows a low-privileged user with page-edit access to perform file system operations with the permissions of the web server process. This can result in site-wide disruption via directory deletion, unauthorized information disclosure through arbitrary file reads, and potential remote code execution pathways if configuration files are overwritten.

Recommendation

• Upgrade Grav to version 2.2.2 or later immediately to address the underlying allowlist bypass logic.
• Review access control lists for the page-edit capability in Grav to ensure that only trusted users possess the ability to modify page content.
• Audit web server logs for HTTP POST requests directed at form processing endpoints containing the 'replace-name@' or 'data-*@' strings as form parameters.