CVE-2026-116019

The record

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.

Affected packages

Related vulnerabilities

• CVE-2026-119978 Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated… CWE-749
• CVE-2026-66088 In openEQUELLA before 2026.1, the system.execute() function available to the scripting… CWE-749
• CVE-2026-118602 Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation… CWE-749
• CVE-2026-118606 Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution… CWE-749
• CVE-2026-113775 A maliciously crafted dynamic library, when loaded from an arbitrary path through the… CWE-749
• CVE-2026-70387 Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus… CWE-749
• CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749
• CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron… CWE-749