CVE-2026-112780

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112780
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112780.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112780
Aliases
  • GHSA-9rq7-4cch-f22j
Published
2026-10-19T19:10:56Z
Modified
2026-10-20T11:16:56Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
Details

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-749"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112780.json"
}
References

Affected packages

Git / github.com/getgrav/grav

Affected ranges

Type
GIT
Repo
https://github.com/getgrav/grav
Events
Introduced
d5f89d95d94cc155bc3be998ee85527a7be073dd
Fixed
d7f46bf3d2eb23600168822e23d67c66f79fbd00
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.0.15"
        },
        {
            "fixed":  "2.2.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

2.*
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112780.json"