Grav CMS CVE-2026-72819

Exploitation requires a valid authenticated user session with at least low-privilege access to the Grav admin interface, consistent with CVSS PR:L. The Flex Objects plugin must be installed and enabled on the target instance - sites that do not use this plugin are not affected. The bypass relies on supplying the unZip routine name in PHP array notation rather than string notation in the settings validation request; no race condition, special network position, or out-of-band channel is required. Exploitation is limited by: (1) the authentication gate - unauthenticated remote attackers cannot trigger this without valid credentials; (2) the Flex Objects plugin dependency - the vulnerable code path is absent if the plugin is not active; (3) web server filesystem permissions - if the PHP process does not have write access to the web root (a non-default hardened configuration), the file-write step will fail and code execution will not occur.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately represents the combination of network accessibility and full-system impact; the primary risk mitigator embedded in the vector is PR:L, meaning exploitation is gated behind a valid authenticated session. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, suggesting it has not yet seen mass opportunistic exploitation. However, the technical disclosure of the exact bypass mechanism - array notation substitution - is specific enough that a skilled attacker can reproduce it without a published POC, elevating practical risk above what the absence of KEV listing alone implies. EPSS score data was not supplied in the available intelligence, so probability-of-exploitation modeling cannot be quantified here. The most significant real-world risk concentrator is Grav deployments that permit open self-registration or that expose the admin panel to untrusted users; in tightly controlled single-author or closed-team deployments the effective risk is substantially lower. No CVSS vector conflict or data inconsistency was identified.

An attacker with a low-privilege registered account - such as a site editor or contributor - logs into an exposed Grav admin panel running a vulnerable version with the Flex Objects plugin active. The attacker constructs a ZIP archive embedding a PHP webshell, then submits an upload request to the Flex Objects settings endpoint with the unZip routine name supplied in array notation to bypass string-based validation. The routine extracts the archive, writing the webshell into the web root; the attacker then sends a direct HTTP GET request to the planted file path and receives an interactive shell running as the web server process.