CVE-2026-112780

{
  "etk_id": "ETK-2026-2082",
  "cve_id": "CVE-2026-112780",
  "display_id": "CVE-2026-112780",
  "ghsa_id": "GHSA-9rq7-4cch-f22j",
  "euvd_id": "EUVD-2026-104586",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Allowlist bypass in Grav Flex form handling",
  "summary": "Grav versions 2.0.15 through before 2.2.2 mishandle method restrictions in Flex form processing. An attacker who already has permission to edit pages may invoke unintended public static functionality, potentially reading files, replacing files, or removing directories.",
  "mitigation": "Upgrade Grav to version 2.2.2 or later. Until upgraded, restrict page-edit permissions to trusted users.",
  "vendor": "getgrav",
  "product": "grav",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.15, < 2.2.2"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "2.2.2"
      ],
      "package_name": "getgrav/grav",
      "purl": "pkg:composer/getgrav/grav"
    }
  ],
  "cwes": [
    749
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.003,
  "epss_percentile": 0.2165,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 53.09178223333333,
  "t0_at": "2026-10-19T19:10:56.708000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-19T21:12:36.999447+00:00",
      "days": 0.08449411396990741,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T19:10:56.708000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T19:10:56.708000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T19:10:56.708000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112780"
    }
  }
}