Grav: Allowlist bypass in Flex form override directives

Summary

Grav versions 2.0.15 up to 2.2.12 contain an allowlist bypass in Flex form overrides. An attacker with page-edit permission can place crafted fields in page frontmatter to call public static methods such as Folder::delete or Utils::download. This can delete directories, overwrite files or read files outside the page tree. Exploitation requires a valid account with page-edit rights.

Affected

• Grav 2.0.15 up to but not including 2.2.13 (vendor range: 2.0.15 through 2.2.12)

Fixed in

• Grav 2.2.13

Workaround

Unknown. The vendor advisory lists no workaround; upgrading to 2.2.13 is the documented remedy.

• Interim measure (not from the vendor): limit page-edit rights to trusted staff and review page frontmatter for unexpected data-*@ or unusual Flex form keys.

Exploitation

• No known exploitation at the time of research.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public proof of concept found.

Our recommendation

• Update Grav to 2.2.13 or later using the normal update cycle, without deferring it.
• Prioritise sites with multiple editors, contractors or partners with editor rights.
• Review editor accounts and page frontmatter for unexpected data-*@ keys until the update is applied.
• Monitor for unexpected file deletions or changes in the page and file directories.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-47gg-mh38-9rr7 github.com
• Grav 2.2.13 release github.com
• Fix commit 4d9e3935 github.com
• VulnCheck advisory www.vulncheck.com
• Blueprint.php at 2.2.12 github.com
• Tenable CVE-2026-116019 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:21.