CVE-2026-72819

HIGH 8.8

Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.

CWE	CWE-94
Vendor	getgrav
Product	grav
Published	Aug 14, 2026

Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new high vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

getgrav / grav

0 < 2.0.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqf vulncheck.com: https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-zip-upload

Credits

🔍 Kuba0123