CVE-2026-114660 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those with user-generated content or public-facing pages, should assess exposure and prioritize patching to prevent unauthorized page deletion.

Why it matters

CVE-2026-114660 is a high-severity vulnerability in Grav that allows unauthorized page deletion via Flex Form Directives. Defenders responsible for Grav installations should assess exposure and prioritize patching to prevent unauthorized page deletion. The vulnerability requires verification of affected versions and remediation to prevent potential data loss or corruption.

• Potential unauthorized page deletion
• Possible data loss or corruption
• Required verification of affected versions and remediation

Technical summary

The vulnerability is caused by an improper access control issue in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete. The vulnerability affects Grav versions from 2.0.0 before 2.2.5 and has been assigned a CVSS score of 7. Defenders should prioritize patching vulnerable Grav installations to prevent unauthorized page deletion.

Defensive priority

Defenders should prioritize patching vulnerable Grav installations to prevent unauthorized page deletion.

Recommended defensive actions

• Patch vulnerable Grav installations to version 2.2.5 or later
• Restrict access to page editing and Flex Form Directives
• Monitor for suspicious page deletion activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. The affected versions are Grav 2.0.0 to 2.2.4. Defenders should verify the versions of Grav in their environment and check for any unauthorized page deletions. The CVE Program and NVD records provide additional information on the vulnerability. There are vendor advisories available for Grav security issues. Third-party advisories also provide information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.