Is there a patch available for CVE-2026-7317?

Yes, a patch is available for CVE-2026-7317. Update the affected software to the latest version immediately.

Grav CMS CVE-2026-7317

Q: What is the CVSS score of CVE-2026-7317?

CVE-2026-7317 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26154 LOW

Improper Input Validation (CWE-20)

2026-04-28 cna@vuldb.com

Deserialization PHP

1.3

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Cache file poisoning requires low-privilege auth and high complexity; impacts are Low without a confirmed RCE gadget chain in Grav's dependencies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:06 vuln.today

Analysis Generated

Jul 24, 2026 - 04:06 vuln.today

CVSS changed

Apr 29, 2026 - 01:12 NVD

2.3 (LOW) 1.3 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 22:22 euvd

EUVD-2026-26154

CVE Published

Apr 28, 2026 - 22:16 nvd

LOW 1.3

DescriptionCVE.org

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.

AnalysisAI

Insecure deserialization in Grav CMS FileCache exposes low-privilege authenticated users to PHP object injection through the FileCache::doGet() method, which calls unserialize() with ['allowed_classes' => true] on cache file contents without integrity verification. Versions 1.7.44 through 1.7.49.5 and 2.0.0-beta.0/beta.1 are affected; the component is not on Grav's default cache path but is reachable by plugins and downstream consumers. Publicly available exploit code exists demonstrating the deserialization primitive, though no active exploitation is recorded in CISA KEV and EPSS sits at 0.05%, reflecting negligible widespread exploitation risk.

Technical ContextAI

Grav CMS's Framework\Cache\Adapter\FileCache class (system/src/Grav/Framework/Cache/Adapter/FileCache.php) reads cached values in doGet() using PHP's native unserialize() with ['allowed_classes' => true], which permits full PHP class instantiation and triggers object magic methods (__wakeup, __destruct, __toString) on attacker-controlled input. The CVE attributes CWE-20 (Improper Input Validation), but the GHSA advisory GHSA-gwfr-jfjf-92vv more precisely identifies CWE-502 (Deserialization of Untrusted Data) as the root cause - the lack of data validation is a consequence of the unsafe deserialization pattern, not the primary weakness. An important architectural note from the GHSA maintainer: this FileCache adapter is not wired into Grav's primary cache path, which uses Symfony's FilesystemAdapter; however, it is reachable by plugins and downstream consumers, making exposure installation-dependent. CPE data confirms affected products as Grav CMS 1.7.44-1.7.49.5 and 2.0.0-beta.0/beta.1. The fix (commit c66dfeb5f) retrofits HMAC integrity using Security::getNonceKey(), versioning the on-disk cache format to prevent deserialization of unsigned or tampered payloads.

RemediationAI

Vendor-released patch: 2.0.0-beta.2, available via Composer (composer require getgrav/grav:^2.0.0-beta.2). The fix in commit c66dfeb5f adds HMAC signing to every cache payload on write using Security::getNonceKey() and verifies the signature on read; tampered, forged, or pre-upgrade cache files are treated as cache misses and removed rather than deserialized. The new on-disk format is versioned (v2\n<expires>\n<key>\n<hmac>\n<serialized>), and existing caches rebuild transparently on first read - no manual cache wipe is required. Patch references: https://github.com/getgrav/grav/commit/c66dfeb5f and https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv. If upgrading to 2.0.0-beta.2 is not immediately possible, operators should harden filesystem permissions on Grav's cache directory to prevent unauthorized file writes (e.g., restrict ownership to the web server process user and remove write access for any other accounts); this eliminates the cache-poisoning precondition but does not fix the underlying unsafe unserialize() call. Additionally, auditing and disabling any plugins that explicitly use Framework\Cache\Adapter\FileCache rather than the default Symfony adapter reduces the attack surface, though this may impact plugin functionality.