CVE-2026-72819 getgrav CVE debrief

Who should care

Defenders responsible for Grav CMS installations, especially those with the Flex Objects plugin enabled, should assess exposure and verify the effectiveness of current security controls.

Why it matters

CVE-2026-72819 is a remote code execution vulnerability in Grav CMS before 2.0.13 that allows authenticated users to execute arbitrary code via ZIP file upload. Defenders should prioritize verifying exposure and assessing security controls.

• Potential code execution requires verification from official sources
• Authenticated user exploitation is possible
• ZIP file upload and PHP code execution are supported consequences

Technical summary

The vulnerability exists in the Flex Objects plugin settings validation of Grav CMS before version 2.0.13. An authenticated user can upload a ZIP file containing PHP code, which can be executed after bypassing routine name validation using array notation. This allows attackers to write PHP files to the web root for execution. The vulnerability has a CVSS score of 8.7, indicating a high severity. Defenders should prioritize verifying exposure of Grav CMS installations, especially those with the Flex Objects plugin enabled.

Defensive priority

Defenders should prioritize verifying exposure of Grav CMS installations, especially those with the Flex Objects plugin enabled, and assess the effectiveness of current security controls.

Recommended defensive actions

• Verify Grav CMS version and Flex Objects plugin usage
• Assess authentication and authorization controls for the plugin
• Monitor for suspicious ZIP file uploads and PHP file creations
• Consider implementing additional security controls, such as web application firewalls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.7 and the affected versions of Grav CMS. The Flex Objects plugin settings validation is vulnerable to remote code execution. Evidence is limited to public CVE and NVD sources. Defenders should verify exposure and assess security controls for Grav CMS installations, especially those with the Flex Objects plugin enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.