Executive brief
Grav CMS is a flat-file content management system used to power websites. Before version 2.0.13, authenticated users could upload a malicious ZIP file and write PHP code to the web root, allowing them to execute arbitrary commands on the server and take complete control of the site.
Technical details
The vulnerability exists in the Flex Objects plugin's settings validation routine. An attacker can bypass routine name validation by using array notation (component + routine name as a pair) instead of string notation, allowing dangerous functions to evade the safety checks. The attacker can then call the unZip routine with a malicious ZIP archive containing a PHP file, which gets extracted directly to the web root where it is executed by the server. The attack requires authentication but no special privileges; exploitation is trivial and the fix (update to 2.0.13) is available.
Affected products
- Grav Grav CMS < 2.0.13
Timeline
- 2026-07-26: disclosed: Original advisory GHSA-r94f-hx44-8jqf published
- 2026-08-14: disclosed: Duplicate advisory GHSA-wvxr-6v52-gfmh published
- 2026-08-14: patched: Version 2.0.13 addresses the vulnerability