Vulnerability · Published Oct 24, 2026 · Assigned by VulnCheck

CVE-2026-116019Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

High 8.8

In plain English

A high-severity security flaw in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	2.0.15 – before 2.2.13

Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-47gg-mh38-9rr7) vendor-advisory
https://github.com/getgrav/grav/commit/4d9e3935f6b79cc1a157914554ccca6066a16f87 patch
grav 2.2.13 Release Notes release-notes
https://github.com/getgrav/grav/blob/2.2.12/system/src/Grav/Common/Data/Blueprint.php technical-description
VulnCheck Advisory: Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives third-party-advisory