CVE-2026-116019

{
  "etk_id": "ETK-2026-2555",
  "cve_id": "CVE-2026-116019",
  "display_id": "CVE-2026-116019",
  "ghsa_id": "GHSA-8xfc-f7mm-8g34",
  "euvd_id": "EUVD-2026-109277",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Allowlist bypass in Grav Flex form overrides",
  "summary": "Grav versions 2.0.15 through 2.2.12 mishandle allowlist checks in Flex form overrides. An attacker who can edit pages may invoke unintended public static methods, potentially reading, replacing, or deleting files outside the intended page area.",
  "mitigation": "Upgrade Grav to version 2.2.13 or later. Until upgrades are complete, restrict page-edit permissions to trusted users.",
  "vendor": "getgrav",
  "product": "grav",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.15, < 2.2.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.2.13"
      ],
      "package_name": "grav",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.594674483333336,
  "t0_at": "2026-10-24T11:40:35.632000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-24T11:40:35.632000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-24T11:40:35.632000+00:00",
      "url": "https://github.com/advisories/GHSA-8xfc-f7mm-8g34"
    }
  }
}