Is CVE-2026-112780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112780 being exploited in the wild.

How severe is CVE-2026-112780?

High severity, with a CVSS score of 8.8, published 19 October 2026.

Is there a fix for CVE-2026-112780?

Yes: fixed in 2.2.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112780 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-112780?

Check whether you run Getgrav Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112780: Grav allowlist bypass in Flex form field renaming

CVE-2026-112780 · Severity: high · CVSS 8.8 · Published 2026-10-19

Grav is a file-based content management system. A vulnerability allows users with page editing permissions to bypass security checks and call arbitrary server-side methods, potentially leading to deletion of directories, modification of files, or unauthorized file access outside the intended content areas.

Technologies: Getgrav Grav. Vendors: Getgrav.

Quick answers

Is CVE-2026-112780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112780 being exploited in the wild.
How severe is CVE-2026-112780?: High severity, with a CVSS score of 8.8, published 19 October 2026.
Which products and versions are affected?: Getgrav Grav 2.0.15 to 2.2.1.
Is there a fix for CVE-2026-112780?: Yes: fixed in 2.2.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112780 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-112780?: Check whether you run Getgrav Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.2.2

Technical details

The vulnerability is an allowlist bypass in Grav's Flex form handling via the replace-name@ directive. When a page editor renames a Flex form field using replace-name@, the field and its directive are moved to a new key that is incorrectly marked as trusted, bypassing the allowed-callable check. This allows invocation of arbitrary public static methods like Folder::delete, Folder::move, or Utils::download with page-edit permissions.

Affected products

getgrav Grav 2.0.15 to 2.2.1

Timeline

2026-10-05: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.