Advisory · CVE-2026-112780
Grav page editors can call arbitrary static methods through a renamed Flex form field
Grav 2.0.15 before 2.2.2 lets page editors smuggle data directives past the callable allowlist by renaming a Flex form field with replace-name@, invoking arbitrary public static methods such as Folder::delete to delete directories, overwrite files, or read files. CVSS 3.1 8.8.
- Vendor
- Grav
- Product
- Grav
- Identifier / CWE
- CVE-2026-112780
CWE-749 - Action timing
- Immediate
Explain it like I’m five
Renaming a form field re-labels it as trusted blueprint content, so the editor's smuggled instructions skip the allowlist check entirely.
- 01Page editor signs in
An account with page-edit permission (api.pages.write, or admin.pages in the classic admin) authors a Flex form in page frontmatter.
- 02Field renamed
The editor renames a field with replace-name@, carrying a data directive naming a public static method.
- 03Trust misassigned
The merge honours the rename before trust is marked, so the directive inherits the file blueprint's trust and skips the allowlist.
- 04Method invoked
Methods such as Folder::delete, Folder::move, or Utils::download run, deleting directories, overwriting files, or reading files.
What happened
Grav disclosed CVE-2026-112780 (CWE-749): since 2.0.15, directives from file blueprints are trusted while page-authored form directives face a Class::method allowlist, but Blueprint::extend() marks incoming fields untrusted as written, and the later merge honours replace-name@ by moving the field, directive included, to a key that was never marked untrusted, so the allowlist is skipped.
The vendor advisory scopes the affected range to Grav 2.0.15 through 2.2.1 and states the 1.7 line is not affected. Fixed in Grav 2.2.2, which removes replace-name@ from untrusted blueprint input before merging.
What to do
- Inventory Grav sites and confirm which run the 2.x line.
- Upgrade affected sites to 2.2.2 or later using the project release guidance.
- Restrict page-edit permissions to named, trusted editors while remediation is underway.
- Hunt for Flex forms in page frontmatter using replace-name@, and for unexpected directory deletions, file moves, or downloads attributable to the web user.
- Verify the deployed version after updating, not just that an update ran.
Management note
Page editors are content staff, not server operators. A rename trick that promotes their input to trusted blueprint status collapses that boundary, so audit editor accounts and recent form changes alongside the upgrade.