{"vulnerability": "CVE-2026-72819", "sightings": [{"uuid": "56f29bcc-54db-4461-97ce-6b3476b9ea17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72819", "type": "seen", "source": "https://gist.github.com/alon710/175ef65f8b7ca8e4e6cd1e9a3b689af4", "content": "# CVE-2026-72819: CVE-2026-72819: Remote Code Execution in Grav CMS via Dynamic Callable Validation Bypass in Blueprint\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72819\n\n## Summary\nCVE-2026-72819 is a high-severity Remote Code Execution (RCE) vulnerability in Grav CMS before version 2.0.13. The vulnerability lies in the validation of dynamic data providers (callbacks) within the Flex Objects plugin settings and blueprints, allowing administrative users to bypass validation checks via array-notation callables. This validation failure enables administrative users to execute arbitrary PHP classes and methods, including the GPM Installer unZip routine, leading to full remote code execution on the server.\n\n## TL;DR\nAuthenticated Remote Code Execution in Grav CMS before 2.0.13 via array-notation dynamic data providers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-72819\n- **CWE ID**: CWE-94\n- **CVSS v3.1 Score**: 8.8 (High)\n- **Exploit Status**: Proof of Concept (PoC) verified\n- **Affected Component**: Blueprint Dynamic Callables\n- **Remediation**: Upgrade to version 2.0.13\n\n## Affected Systems\n\n- Grav CMS\n- **Grav CMS**: < 2.0.13 (Fixed in: `2.0.13`)\n\n## Mitigation\n\n- Upgrade Grav CMS to version 2.0.13 or later.\n- Restrict administrative interface access to trusted networks or IP ranges.\n- Implement Web Application Firewall (WAF) rules targeting raw YAML configuration modifications in request streams.\n- Harden filesystem permissions, ensuring that the web daemon has write restrictions on the root application directory.\n\n**Remediation Steps:**\n1. Back up existing Grav CMS installations, configurations, and core user directories.\n2. Upgrade the Grav CMS system using administrative CLI tools or official packaging systems to version 2.0.13.\n3. Verify the validation logic update inside system/src/Grav/Common/Data/Blueprint.php.\n4. Inspect user-defined blueprints and Flex Objects configurations for array configurations using callables.\n5. Monitor web server error logs and execution paths for indicators of unauthorized file extractions.\n\n## References\n\n- [GitHub Security Advisory GHSA-r94f-hx44-8jqf](https://github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqf)\n- [Fix Commit 81740e23614c3f3f520dbd8dc7a7af21efd0b747](https://github.com/getgrav/grav/commit/81740e23614c3f3f520dbd8dc7a7af21efd0b747)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72819) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T21:32:03.469331Z"}, {"uuid": "be942c7b-b298-4cb6-a8c1-22a5b747ba82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72819", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvqno2xs5f2f", "content": "CVE-2026-72819 - grav\nAn attacker with Grav CMS access can upload a malicious ZIP file containing code, which can be executed on the server. This is a serious risk because it allows an attacker to gain\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #PHP #CVE #infosec", "creation_timestamp": "2026-09-17T22:00:10.021591Z"}, {"uuid": "3c86c521-f5bd-420a-8d8c-55dc363add2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72819", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-r94f-hx44-8jqf", "content": "", "creation_timestamp": "2026-09-17T22:35:02.460538Z"}]}