The vulnerability is found in Grav CMS’s Cache Value Handler, specifically in the FileCache::doGet method. When a crafted cache entry is processed, the system deserializes the data without validating its content. The CVE description indicates that this can be triggered remotely and is considered complex and difficult to exploit. While the exact consequences are not specified, deserialization vulnerabilities typically allow attackers to inject arbitrary objects into the application, which could lead to unintended behavior depending on how the application uses the deserialized data.

Grav CMS versions up to 1.7.49.5 and 2.0.0‑beta.1 are affected. Upgrading to 2.0.0‑beta.2 or later, which includes commit c66dfeb5f, resolves the issue.

With a CVSS score of 2.3 and no EPSS data, the likelihood of widespread exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Public exploit material has been released, so an attacker who can control cache entries may attempt to trigger the vulnerable deserialization path. The attack may be launched remotely, but the CVE description points out that it requires a high level of complexity and the exploitation is difficult, suggesting that successful exploitation will likely need a targeted approach.