CVE-2026-112780

HighCVSS 8.8/10Last modified Oct 22, 2026

Description

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-749

Affected software

Vendor	Product	Versions
getgrav	grav	>= 2.0.15, < 2.2.2

References

Timeline

Published: Oct 19, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1127816.5Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by ad CVE-2026-1127827.5Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypas CVE-2026-1127834.3OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-CVE-2026-1127844.3OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to se CVE-2026-1127854.3OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate s CVE-2026-1127865.4OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated CVE-2026-1127874.3OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view CVE-2026-1127894.7Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attack CVE-2026-112798.8Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-1127907.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-1127917.0Time-of-check time-of-use (toctou) race condition in Windows Print Spooler Components allows an authorized attacker to elevate privileges lo CVE-2026-1127927.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.