Grav CMS CVE-2026-72702

Exploitation requires that the target route relies on the vulnerable Referer-based origin validation in Uri::referrer() or Pages::referrerRoute(), and that the attacker can present a Referer value beginning with the victim site's base origin - achievable either by directly setting the Referer header in a scripted request or by controlling a domain that starts with the victim origin (e.g. https://example.com.attacker.tld). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required for the origin bypass itself. Limiting factors: the practical impact depends entirely on what functionality the Referer check gates (the bypass is a stepping stone, not direct code execution), and it only affects Grav versions before 2.0.16.

The supplied CVSS 4.0 vector (9.3, AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) rates this Critical, treating it as a fully unauthenticated network attack with high confidentiality, integrity and availability impact. That impact rating deserves scrutiny: the vulnerability itself is only an origin-check bypass - its real severity is bounded by what the Referer check was gating (typically CSRF-style state-changing actions), so full CIA:H is arguably aggressive unless the bypass reaches admin/state-changing functionality. There is no EPSS score, no POC, and no KEV listing provided, so the exploitation-probability signals are absent rather than reassuring; the SSVC exploitation status is best read as 'none/POC-unproven.' On balance this is a legitimate high-priority hardening fix - the bypass is low-complexity and needs no authentication - but the 9.3 headline likely overstates the standalone technical impact; teams should confirm which endpoints the Referer check protects before treating it as equivalent to unauthenticated RCE. Any organization running internet-facing Grav should still patch promptly given the trivial exploitation mechanics.

An attacker registers a look-alike domain whose name begins with the victim's origin string, such as https://victim.example.com.attacker.tld, then issues a crafted request to the Grav site with that value in the Referer header (settable directly via a script or curl). The origin check's unanchored prefix match accepts the forged Referer as same-origin, allowing the attacker to invoke actions the Referer check was meant to protect. No public exploit code is currently identified, but the technique is straightforward.