CVE-2026-7317 (GCVE-0-2026-7317)

Vulnerability from cvelistv5 – Published: 2026-04-28 20:30 – Updated: 2026-04-29 13:01 X_Open Source

Title

Grav CMS Cache Value FileCache.php doGet deserialization

Summary

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-502 - Deserialization
CWE-20 - Improper Input Validation

Assigner

VulDB

References

6 references

URL	Tags
https://vuldb.com/vuln/359965	vdb-entrytechnical-description
https://vuldb.com/vuln/359965/cti	signaturepermissions-required
https://vuldb.com/submit/798732	third-party-advisory
https://github.com/devsamuelsantiago/grav-cms-fil…	exploit
https://github.com/getgrav/grav/security/advisori…	related
https://github.com/getgrav/grav/commit/c66dfeb5f	patch

Impacted products

1 product

Vendor	Product	Version
Grav	CMS	Affected: 1.7.49.0 Affected: 1.7.49.1 Affected: 1.7.49.2 Affected: 1.7.49.3 Affected: 1.7.49.4 Affected: 1.7.49.5 Affected: 2.0.0-beta.0 Affected: 2.0.0-beta.1 Unaffected: 2.0.0-beta.2

Credits

s4nnty (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7317",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-29T12:59:03.495809Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-29T13:01:56.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Cache Value Handler"
          ],
          "product": "CMS",
          "vendor": "Grav",
          "versions": [
            {
              "status": "affected",
              "version": "1.7.49.0"
            },
            {
              "status": "affected",
              "version": "1.7.49.1"
            },
            {
              "status": "affected",
              "version": "1.7.49.2"
            },
            {
              "status": "affected",
              "version": "1.7.49.3"
            },
            {
              "status": "affected",
              "version": "1.7.49.4"
            },
            {
              "status": "affected",
              "version": "1.7.49.5"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.0"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.1"
            },
            {
              "status": "unaffected",
              "version": "2.0.0-beta.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "s4nnty (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.6,
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T20:30:16.285Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-359965 | Grav CMS Cache Value FileCache.php doGet deserialization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/359965"
        },
        {
          "name": "VDB-359965 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/359965/cti"
        },
        {
          "name": "Submit #798732 | Trilby Media Grav CMS \u003e= 1.7.44, \u003c= 1.7.49.5 Deserialization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/798732"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/getgrav/grav/commit/c66dfeb5f"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-04-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-04-28T15:18:04.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Grav CMS Cache Value FileCache.php doGet deserialization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-7317",
    "datePublished": "2026-04-28T20:30:16.285Z",
    "dateReserved": "2026-04-28T13:11:54.929Z",
    "dateUpdated": "2026-04-29T13:01:56.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-7317",
      "date": "2026-07-24",
      "epss": "0.00224",
      "percentile": "0.13081"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-7317\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-04-28T22:16:51.710\",\"lastModified\":\"2026-07-24T08:10:00.150\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad fue encontrada en Grav CMS hasta 1.7.49.5/2.0.0-beta.1. Afectada por esta vulnerabilidad es la funci\u00f3n FileCache::doGet del archivo system/src/Grav/Framework/Cache/Adapter/FileCache.php del componente Gestor de Valores de Cach\u00e9. La manipulaci\u00f3n resulta en deserializaci\u00f3n. El ataque puede ser lanzado remotamente. El ataque requiere un alto nivel de complejidad. La explotaci\u00f3n parece ser dif\u00edcil. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado. Actualizar a la versi\u00f3n 2.0.0-beta.2 aborda este problema. El parche es identificado como c66dfeb5f. El componente afectado deber\u00eda ser actualizado.\"}],\"affected\":[{\"source\":\"cna@vuldb.com\",\"affectedData\":[{\"vendor\":\"Grav\",\"product\":\"CMS\",\"modules\":[\"Cache Value Handler\"],\"versions\":[{\"version\":\"1.7.49.0\",\"status\":\"affected\"},{\"version\":\"1.7.49.1\",\"status\":\"affected\"},{\"version\":\"1.7.49.2\",\"status\":\"affected\"},{\"version\":\"1.7.49.3\",\"status\":\"affected\"},{\"version\":\"1.7.49.4\",\"status\":\"affected\"},{\"version\":\"1.7.49.5\",\"status\":\"affected\"},{\"version\":\"2.0.0-beta.0\",\"status\":\"affected\"},{\"version\":\"2.0.0-beta.1\",\"status\":\"affected\"},{\"version\":\"2.0.0-beta.2\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":1.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:S/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-29T12:59:03.495809Z\",\"id\":\"CVE-2026-7317\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"references\":[{\"url\":\"https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/getgrav/grav/commit/c66dfeb5f\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/submit/798732\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/359965\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/359965/cti\",\"source\":\"cna@vuldb.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:50:18+00:00",
      "cve": "CVE-2026-7317",
      "id": "CVE-2026-7317",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Grav CMS Cache Value FileCache.php doGet deserialization",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7317.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-7317\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-29T12:59:03.495809Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-29T12:59:12.110Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"Grav CMS Cache Value FileCache.php doGet deserialization\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"s4nnty (VulDB User)\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 4.6, \"vectorString\": \"AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C\"}}], \"affected\": [{\"vendor\": \"Grav\", \"modules\": [\"Cache Value Handler\"], \"product\": \"CMS\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.7.49.0\"}, {\"status\": \"affected\", \"version\": \"1.7.49.1\"}, {\"status\": \"affected\", \"version\": \"1.7.49.2\"}, {\"status\": \"affected\", \"version\": \"1.7.49.3\"}, {\"status\": \"affected\", \"version\": \"1.7.49.4\"}, {\"status\": \"affected\", \"version\": \"1.7.49.5\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.0\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.1\"}, {\"status\": \"unaffected\", \"version\": \"2.0.0-beta.2\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-28T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-04-28T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-04-28T15:18:04.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/359965\", \"name\": \"VDB-359965 | Grav CMS Cache Value FileCache.php doGet deserialization\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/359965/cti\", \"name\": \"VDB-359965 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/submit/798732\", \"name\": \"Submit #798732 | Trilby Media Grav CMS \u003e= 1.7.44, \u003c= 1.7.49.5 Deserialization\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/getgrav/grav/commit/c66dfeb5f\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"Deserialization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-04-28T20:30:16.285Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-7317\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-29T13:01:56.731Z\", \"dateReserved\": \"2026-04-28T13:11:54.929Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-04-28T20:30:16.285Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-7317

Vulnerability from fkie_nvd - Published: 2026-04-28 22:16 - Updated: 2026-06-17 11:02

Severity

5.0 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	cna@vuldb.com	https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection
	cna@vuldb.com	https://github.com/getgrav/grav/commit/c66dfeb5f
	cna@vuldb.com	https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv
	cna@vuldb.com	https://vuldb.com/submit/798732
	cna@vuldb.com	https://vuldb.com/vuln/359965
	cna@vuldb.com	https://vuldb.com/vuln/359965/cti

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "modules": [
            "Cache Value Handler"
          ],
          "product": "CMS",
          "vendor": "Grav",
          "versions": [
            {
              "status": "affected",
              "version": "1.7.49.0"
            },
            {
              "status": "affected",
              "version": "1.7.49.1"
            },
            {
              "status": "affected",
              "version": "1.7.49.2"
            },
            {
              "status": "affected",
              "version": "1.7.49.3"
            },
            {
              "status": "affected",
              "version": "1.7.49.4"
            },
            {
              "status": "affected",
              "version": "1.7.49.5"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.0"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.1"
            },
            {
              "status": "unaffected",
              "version": "2.0.0-beta.2"
            }
          ]
        }
      ],
      "source": "cna@vuldb.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded."
    }
  ],
  "id": "CVE-2026-7317",
  "lastModified": "2026-06-17T11:02:11.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 1.3,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-7317",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-29T12:59:03.495809Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-28T22:16:51.710",
  "references": [
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/getgrav/grav/commit/c66dfeb5f"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/submit/798732"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/359965"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/359965/cti"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GWFR-JFJF-92VV

Vulnerability from github – Published: 2026-05-05 21:29 – Updated: 2026-05-08 15:36

Summary

Grav has Insecure Deserialization in File Cache

Details

Insecure Deserialization in File Cache

Severity: High
CWE: CWE-502
Location: system/src/Grav/Framework/Cache/Adapter/FileCache.php
Sink: unserialize($value, ['allowed_classes' => true])

Affected version(s)

Affected: >= 1.7.44 and <= 1.7.49.5 (verified in current codebase and changelog-covered releases).
Fixed: No upstream fix identified in the reviewed branch at the time of analysis.
Notes: Earlier 1.7.x releases may also be affected, but were not fully back-traced in this review.

Notes

allowed_classes => true allows object instantiation and does not constrain classes.

PoC (Primitive Demonstration)

Preconditions

Local PHP runtime.
Goal is to validate the deserialization primitive used in cache retrieval.

Steps

php -r '
class CacheWakeup { public function __wakeup(){ file_put_contents("/tmp/grav_filecache_poc.txt", "wakeup"); } }

$payload = serialize(new CacheWakeup());
unserialize($payload, ["allowed_classes" => true]);

echo file_exists("/tmp/grav_filecache_poc.txt") ? "FILECACHE_UNSERIALIZE_TRIGGERED\n" : "FILECACHE_UNSERIALIZE_NOT_TRIGGERED\n";
'

Expected Result

Output contains: FILECACHE_UNSERIALIZE_TRIGGERED.

Interpretation

This reproduces the same unsafe primitive used by FileCache::doGet(): unserialize($value, ['allowed_classes' => true]). If cache files are attacker-tampered, object magic methods may execute.

Exploit Preconditions

Cache file poisoning/tampering capability.

Recommendation

Avoid object deserialization in cache payloads.
Use non-object formats and integrity protection for cache files.

Maintainer note — fix applied (2026-04-24)

Fixed in Grav core on the 2.0 branch: commit c66dfeb5f — will ship in 2.0.0-beta.2.

What changed: Framework\Cache\Adapter\FileCache now HMAC-signs every cache payload with Security::getNonceKey() on write, and verifies the HMAC on read. Tampered, forged, or pre-upgrade files are treated as cache misses and unlinked instead of being unserialized. The on-disk format is now versioned:

v2
<expires>
<key>
<hmac-hex>
<serialized>

Existing caches rebuild transparently on first read. Note that Framework\Cache\Adapter\FileCache isn't wired into Grav's main cache path — Symfony's FilesystemAdapter is — but the class is reachable by plugin and downstream consumers, so the hardening applies defensively.

Files: - system/src/Grav/Framework/Cache/Adapter/FileCache.php. - tests/unit/Grav/Common/Security/FileCacheSecurityTest.php — round-trip, tampered-payload rejection, wrong-key forgery rejection, pre-v2 file rebuild, key-field mismatch.

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

1.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0-beta.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-7317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:29:29Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "# Insecure Deserialization in File Cache\n\n- **Severity:** High \n- **CWE:** CWE-502\n- **Location:** `system/src/Grav/Framework/Cache/Adapter/FileCache.php`\n- **Sink:** `unserialize($value, [\u0027allowed_classes\u0027 =\u003e true])`\n\n## Affected version(s)\n\n- **Affected:** `\u003e= 1.7.44` and `\u003c= 1.7.49.5` (verified in current codebase and changelog-covered releases).\n- **Fixed:** No upstream fix identified in the reviewed branch at the time of analysis.\n- **Notes:** Earlier `1.7.x` releases may also be affected, but were not fully back-traced in this review.\n\n## Notes\n`allowed_classes =\u003e true` allows object instantiation and does not constrain classes.\n\n## PoC (Primitive Demonstration)\n\n### Preconditions\n- Local PHP runtime.\n- Goal is to validate the deserialization primitive used in cache retrieval.\n\n### Steps\n```bash\nphp -r \u0027\nclass CacheWakeup { public function __wakeup(){ file_put_contents(\"/tmp/grav_filecache_poc.txt\", \"wakeup\"); } }\n\n$payload = serialize(new CacheWakeup());\nunserialize($payload, [\"allowed_classes\" =\u003e true]);\n\necho file_exists(\"/tmp/grav_filecache_poc.txt\") ? \"FILECACHE_UNSERIALIZE_TRIGGERED\\n\" : \"FILECACHE_UNSERIALIZE_NOT_TRIGGERED\\n\";\n\u0027\n```\n\n### Expected Result\n- Output contains: `FILECACHE_UNSERIALIZE_TRIGGERED`.\n\n### Interpretation\nThis reproduces the same unsafe primitive used by `FileCache::doGet()`:\n`unserialize($value, [\u0027allowed_classes\u0027 =\u003e true])`.\nIf cache files are attacker-tampered, object magic methods may execute.\n\n## Exploit Preconditions\n- Cache file poisoning/tampering capability.\n\n## Recommendation\n- Avoid object deserialization in cache payloads.\n- Use non-object formats and integrity protection for cache files.\n\n\n\n---\n\n## Maintainer note \u2014 fix applied (2026-04-24)\n\nFixed in Grav core on the `2.0` branch: commit [`c66dfeb5f`](https://github.com/getgrav/grav/commit/c66dfeb5f) \u2014 will ship in **2.0.0-beta.2**.\n\n**What changed:** `Framework\\Cache\\Adapter\\FileCache` now HMAC-signs every cache payload with `Security::getNonceKey()` on write, and verifies the HMAC on read. Tampered, forged, or pre-upgrade files are treated as cache misses and unlinked instead of being unserialized. The on-disk format is now versioned:\n\n```\nv2\n\u003cexpires\u003e\n\u003ckey\u003e\n\u003chmac-hex\u003e\n\u003cserialized\u003e\n```\n\nExisting caches rebuild transparently on first read. Note that `Framework\\Cache\\Adapter\\FileCache` isn\u0027t wired into Grav\u0027s main cache path \u2014 Symfony\u0027s `FilesystemAdapter` is \u2014 but the class is reachable by plugin and downstream consumers, so the hardening applies defensively.\n\n**Files:**\n- [`system/src/Grav/Framework/Cache/Adapter/FileCache.php`](https://github.com/getgrav/grav/blob/2.0/system/src/Grav/Framework/Cache/Adapter/FileCache.php).\n- [`tests/unit/Grav/Common/Security/FileCacheSecurityTest.php`](https://github.com/getgrav/grav/blob/2.0/tests/unit/Grav/Common/Security/FileCacheSecurityTest.php) \u2014 round-trip, tampered-payload rejection, wrong-key forgery rejection, pre-v2 file rebuild, key-field mismatch.",
  "id": "GHSA-gwfr-jfjf-92vv",
  "modified": "2026-05-08T15:36:36Z",
  "published": "2026-05-05T21:29:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/c66dfeb5f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/798732"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359965"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359965/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav has Insecure Deserialization in File Cache"
}

GHSA-J7RW-325J-2RMX

Vulnerability from github – Published: 2026-04-29 00:30 – Updated: 2026-05-06 21:57

Summary

Duplicate Advisory: Grav has Insecure Deserialization in File Cache

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gwfr-jfjf-92vv. This link is maintained to preserve external references.

Original Description

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

1.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0-beta.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T21:57:13Z",
    "nvd_published_at": "2026-04-28T22:16:51Z",
    "severity": "LOW"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-gwfr-jfjf-92vv. This link is maintained to preserve external references.\n\n### Original Description\nA vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.",
  "id": "GHSA-j7rw-325j-2rmx",
  "modified": "2026-05-06T21:57:13Z",
  "published": "2026-04-29T00:30:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/c66dfeb5f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/798732"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359965"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359965/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Grav has Insecure Deserialization in File Cache",
  "withdrawn": "2026-05-06T21:57:13Z"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-7317 (GCVE-0-2026-7317)

FKIE_CVE-2026-7317

GHSA-GWFR-JFJF-92VV

Insecure Deserialization in File Cache

Affected version(s)

Notes

PoC (Primitive Demonstration)

Preconditions

Steps

Expected Result

Interpretation

Exploit Preconditions

Recommendation

Maintainer note — fix applied (2026-04-24)

GHSA-J7RW-325J-2RMX

Duplicate Advisory

Original Description

Tags

Sightings

Nomenclature