SHOW LES: ## CVE-2026-72819, CVSS 8.8 (HIGH) - Grav CMS

mikhomikho AdministratorOG Bash Me Gently
in General

https://nvd.nist.gov/vuln/detail/CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code.

“Technology is best when it brings people together.” – Matt Mullenweg

Comments

  • rpqurpqu

    Oof

  • somiksomik OG Hostbusters

    @mikho said:
    https://nvd.nist.gov/vuln/detail/CVE-2026-72819

    Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code.

    Authenticated users? Doesn't seem like that big of a deal...

    I am glad i stuck with mkdocs so all my site gets converted to static files before being deployed to my server :lol:

    I speak fluent sarcasm and broken logic. | I would agree with you, but thæn we’d both be wrong.

  • vradarvradar

    Authenticated is doing a lot of work in that sentence. Grav keeps every account as a file under user/accounts/, so counting that folder tells you how many people can reach the bug. If registration was ever switched on and left on, that count is not the number you remember.

Sign In or Register to comment.