{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav-2.0.15-2.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-112780"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav (2.0.15-2.2.1)","Grav (1.7.53 - 1.7.53.4)","Grav (2.0.0-rc.8 - 2.2.1)"],"_cs_severities":["high"],"_cs_tags":["webserver","cms","bypass"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eGrav versions 2.0.15 through 2.2.1 contain an allowlist bypass vulnerability (CVE-2026-112780) within the Flex form processing logic. This vulnerability allows an authenticated user with page-edit permissions to manipulate form fields by leveraging the 'replace-name@' syntax. By smuggling 'data-*@' directives past the application's internal callable check, an attacker can invoke unauthorized public static methods. Exploitation of this vulnerability grants the attacker the ability to perform sensitive file system operations, including the deletion of directories via 'Folder::delete', the movement of files via 'Folder::move', or unauthorized file reads through 'Utils::download'. This vulnerability poses a significant risk to the integrity and confidentiality of the CMS installation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged user with page-edit access to perform file system operations with the permissions of the web server process. This can result in site-wide disruption via directory deletion, unauthorized information disclosure through arbitrary file reads, and potential remote code execution pathways if configuration files are overwritten.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Grav to version 2.2.2 or later immediately to address the underlying allowlist bypass logic.\u003c/li\u003e\n\u003cli\u003eReview access control lists for the page-edit capability in Grav to ensure that only trusted users possess the ability to modify page content.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for HTTP POST requests directed at form processing endpoints containing the 'replace-name@' or 'data-*@' strings as form parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T22:23:59Z","date_published":"2026-10-19T22:23:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grav-bypass/","summary":"Grav versions 2.0.15 through 2.2.1 contain an allowlist bypass vulnerability allowing authenticated page editors to execute arbitrary public static methods, leading to unauthorized file system operations.","title":"Grav Allowlist Bypass Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-grav-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav (2.0.15-2.2.1)","version":"https://jsonfeed.org/version/1.1"}