Technical impact
Grav 2.0.15 through 2.2.12 contains an allowlist bypass that lets page editors invoke arbitrary public static methods by manipulating Flex form override directives. The vulnerability permits actions such as deleting directories, overwriting files, and reading files outside the page tree, effectively allowing attackers with page‑edit permissions to execute arbitrary code on the server.
Affected Systems
The affected product is Grav by getgrav, specifically all releases from 2.0.15 up to and including 2.2.12. Users running any of these versions are at risk if they grant page‑edit rights to individuals or roles.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity impact. Although an EPSS score is not available, the vulnerability provides a clear path for exploitation: a user with page‑edit permission can embed crafted Flex form overrides in a page frontmatter, triggering calls to vulnerable static methods such as Folder::delete or Utils::download. This can lead to deletion or modification of critical files and potential data loss. The vulnerability is not currently listed in CISA’s KEV catalog, but the severity warrants immediate attention.
