Grav includes a bypass of a public static method allowlist that lets users with page‑edit permissions rename Flex form fields using the replace-name@ syntax. This allows the attacker to invoke arbitrary public static methods, including Folder::delete, Folder::move, and Utils::download, which can delete directories, overwrite files, or read files, effectively enabling destructive or exfiltration actions. The weakness is related to CWE‑749, an allowlist bypass that permits execution of unintended code paths.

The product affected is Grav, a flat‑file CMS, versions 2.0.15 through 2.2.1. Users running these releases are at risk if they have page editors who can alter form field names.

The CVSS score of 9.3 indicates high severity, and the exploitability is likely given that the attacker merely needs page‑editing capabilities, a privilege that many content collaborators possess. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, but the impact remains significant due to the potential for remote code execution.