Grav CMS versions earlier than 2.0.13 contain a flaw in the Flex Objects plugin that allows authenticated users to upload a ZIP archive containing PHP code. By using array notation to bypass routine name validation, an attacker can trigger the unZip routine and have malicious PHP files written to the web root, where they will be executed. This vulnerability directly leads to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

All installations of Grav CMS by getgrav running a version older than 2.0.13 are vulnerable when the Flex Objects plugin is present and active. The flaw requires the user to be authenticated within the CMS, as only those users can upload ZIP files through the plugin.

The CVSS score of 8.7 indicates a high severity risk. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the nature of the vulnerability—remote code execution through authenticated file upload—means that an attacker with valid credentials can completely compromise the server. The likely attack vector is an authenticated user uploading a specially crafted ZIP archive via the Flex Objects plugin, which then triggers the unZip routine to place executable PHP code on the web root.