⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 17, 2026

GHSA-wvxr-6v52-gfmhHighCVSS 8.8Disclosed before NVD

Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS

Published
August 14, 2026
Last Modified
September 17, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r94f-hx44-8jqf. This link is maintained to preserve external references.

Original Description

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.

🎯 Affected products1

  • composer/getgrav/grav:< 2.0.13

🔗 References (4)