CVE-2026-72819

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.13

Description Authenticated users can achieve remote code execution through a flaw in the Flex Objects plugin settings validation. By utilizing array notation instead of string notation, an attacker can bypass routine name validation to call the unZip() routine with a malicious ZIP archive. This process allows the upload and writing of PHP files directly to the web root for subsequent execution.

Recommendations Update Grav CMS to version 2.0.13 or later.