CVE-2026-72702

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16

Description An origin validation bypass exists in the Uri::referrer() and Pages::referrerRoute() methods. The issue occurs because the Referer header is validated using an unanchored string prefix match via str starts with($referrer, $base) without a trailing delimiter. This allows an attacker controlling a domain that starts with the victim site's origin to send a request that is incorrectly treated as same-origin, bypassing the origin check.

Recommendations Update Grav CMS to version 2.0.16 or later.