Log in Start free

Vulnerability · Published Apr 28, 2026 · Assigned by VulDB

CVE-2026-7317Grav CMS Cache Value FileCache.php doGet deserialization

Medium 5.0

In plain English

A medium-severity unsafe deserialization in CMS from Grav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.2%top 86.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistgetgrav/grav2.0.0-beta.2GHSA-gwfr-jfjf-92vv

Affected products (as reported)

VendorProductVersions
Grav CMS 1.7.49.01.7.49.11.7.49.21.7.49.31.7.49.41.7.49.52.0.0-beta.02.0.0-beta.1

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References