CVE-2026-72819

HighCVSS 8.8

Published: 14/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Summary

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation. An authenticated user can upload a ZIP file containing PHP code, bypass name validation using array notation, and write PHP files to the web root for execution.

Risk Assessment

An attacker with a user account can take over the server by executing arbitrary code, potentially compromising data confidentiality, integrity, and availability.

Recommendation

Immediately upgrade Grav CMS to version 2.0.13 or later and restrict access to the admin panel.

Original NVD description (English source)

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.