Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.2.13
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Grav, an open-source flat-file content management system, is affected in versions from 2.0.15 up to (but not including) the patched release. An attacker with page-editing permission can abuse Flex form override fields to run unauthorized server-side methods, which could delete directories, overwrite files, or read files outside the page content area.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- getgrav grav
From 2.0.15 · fixed in 2.2.13