CVE-2026-114660
CVE-2026-114660 · Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
CVSS 7.0 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
grav
- Versions
- ≥ 2.0.0, < 2.2.5: Affected (semver)
- 2.2.5: Not affected (semver)
Update to 2.2.5