Update Grav CMS to 2.2.2 to Stop Page Editors Deleting Files via CVE-2026-112780
Page editors in vulnerable Grav versions can bypass allowlists to delete directories or read files by renaming form fields.
Key points
- CVE-2026-112780 allows arbitrary static method calls via Flex form field renaming.
- The flaw affects Grav versions from 2.0.15 up to, but not including, 2.2.2.
- Attackers can invoke Folder::delete, Folder::move, or Utils::download functions.
Security teams managing Grav CMS instances must verify their version status immediately. A critical vulnerability, CVE-2026-112780, exists in Grav versions ranging from 2.0.15 through those preceding 2.2.2. This flaw allows users with page-editing permissions to execute arbitrary public static methods. The issue stems from an allowlist bypass within the Flex forms system. Attackers exploit this by renaming form fields using the replace-name@ syntax.
The risk
The vulnerability carries a CVSS score of 9.3, classified as critical. According to the National Vulnerability Database record, the weakness aligns with CWE-749, which pertains to incorrect behavior specification. By smuggling data-*@ directives past the callable check, attackers can invoke sensitive system functions. Specifically, they can call Folder::delete to remove directories, Folder::move to overwrite files, or Utils::download to read file contents. This turns standard editing workflows into a vector for severe data manipulation and loss.
Who is exposed
Any organization running Grav CMS versions prior to 2.2.2 is exposed to this risk. The vulnerability specifically targets environments where users hold page-edit permissions. If your infrastructure relies on Grav for content management and has not been updated to version 2.2.2, your systems are vulnerable to this allowlist bypass. The flaw does not require administrative privileges, only the ability to edit pages, making it accessible to a broader range of potential attackers within the user base.
Cost and compliance
The source material does not provide specific details regarding financial costs, regulatory compliance impacts, or known exploitation in the wild. No data is available on the number of affected organizations or specific incidents linked to CVE-2026-112780. Consequently, no further commentary on compliance implications or economic damage can be derived from the provided records. Teams should rely on the technical severity of the flaw to determine urgency.
Our take on the response
The presence of a specific version cutoff indicates a clear remediation path. Organizations should prioritize updating to version 2.2.2 or later to eliminate this attack surface. That suggests immediate inventory checks are necessary to identify all instances of Grav CMS. Delaying the update leaves the system open to method injection attacks that can compromise data integrity and availability.
What defenders should look for
Teams usually monitor for unusual file system changes originating from web application processes. Check whether page editors are modifying form structures in ways that trigger unexpected backend actions. Look for alerts related to mass deletions or unauthorized file movements within content directories. Investigate any sudden appearance of missing directories or overwritten configuration files. Review access logs for rapid sequences of form submissions that deviate from normal editing patterns. Contain potential breaches by isolating affected web servers and verifying file integrity against known good baselines.
What to do and how to stay safe: Grav CMS
- Audit your Grav CMS installations to identify any versions earlier than 2.2.2.
- Restrict page-editing permissions to only those users who strictly require them.
- Monitor server logs for unexpected invocations of Folder::delete or Utils::download.
- Apply the vendor update to version 2.2.2 once the vendor provides an update.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Grav CMS versions are affected by CVE-2026-112780?
Versions from 2.0.15 up to, but not including, 2.2.2 are affected.
What specific actions can an attacker perform using this vulnerability?
Attackers can delete directories, overwrite files, or read files by invoking static methods.
Is there a fix available for this critical vulnerability?
Yes, upgrading to Grav version 2.2.2 addresses this allowlist bypass vulnerability.
