Grav versions 2.0.0 through 2.2.4 contain an improper access control flaw in the FlexDirectory::dynamicFlexField() routine that allows any page author with edit rights to execute arbitrary Flex object methods by inserting flex-*@ directives into a page’s frontmatter. This flaw enables the deletion of protected pages that authors normally cannot remove, resulting in loss of content and potential site disruption. The weakness is identified as CWE-470, improper use of code from untrusted input.

The vulnerability affects the Grav content‑management system from the vendor getgrav, specifically all releases from 2.0.0 up to but not including 2.2.5. Any installation using these versions that permits page authors to edit frontmatter is susceptible.

The CVSS score of 7 indicates a high severity exposure. Although EPSS data is not provided, the lack of a KEV listing suggests no known public exploits yet, but the attack vector is relatively straightforward for legitimate page editors. An adversary who can get an editor access can trigger page deletion without requiring elevated system privileges.