What is GHSA-wvxr-6v52-gfmh?

GHSA-wvxr-6v52-gfmh is a security advisory published by GitHub Security Advisories with High severity. Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin...

Which CVE IDs does GHSA-wvxr-6v52-gfmh cover?

GHSA-wvxr-6v52-gfmh covers the following CVE IDs: CVE-2026-72819. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wvxr-6v52-gfmh?

GHSA-wvxr-6v52-gfmh has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-wvxr-6v52-gfmhHighCVSS 8.8

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin...

Vendor

GitHub Security Advisories

Published

August 14, 2026

Last Modified

August 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-72819 →

📋 Description

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqf
https://nvd.nist.gov/vuln/detail/CVE-2026-72819
https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-zip-upload
https://github.com/advisories/GHSA-wvxr-6v52-gfmh