CVE-2026-72819: Grav CMS RCE via ZIP Upload Bypass in Flex Objects Plugin

Overview

A high-severity remote code execution vulnerability has been patched in Grav CMS, a file-based flat-file content management system. CVE-2026-72819 (CVSS 8.8 — High) targets the Flex Objects plugin's settings validation and allows an authenticated attacker to upload a ZIP archive containing arbitrary PHP code, then trigger execution of that code on the server. The bypass exploits a gap in the filename validation logic that fails to account for PHP's array-notation parameter parsing.

Vulnerability Details

Grav's Flex Objects plugin allows administrators to upload configuration archives through the CMS admin panel. The file upload handler applies routine name validation to reject archives containing dangerous file extensions (e.g., .php, .phar). However, the validation contains a critical blind spot:

• Array notation bypass: When a filename is expressed using array notation (e.g., shell[0].php), the validation routine interprets only the array key portion and misses the embedded .php extension in the value.
• An attacker crafts a ZIP file with entries named using this pattern. The archive passes validation and is extracted, placing a .php file in an accessible directory on the server.
• A subsequent HTTP request to the extracted file path causes the web server to execute the PHP payload, granting the attacker arbitrary command execution.

Attack Requirements

This vulnerability requires authentication — the attacker must have a valid Grav admin account (or lower-privileged account with file upload access). However, in environments where:

• User registration is open.
• Weak or default admin credentials are in use.
• The admin panel is accessible from the internet.

...the practical barrier is low. The CVSS score of 8.8 reflects the authentication prerequisite reducing it from critical to high.

Impact

Affected Versions

• Grav CMS < 2.0.13 — all versions prior to the patch release.

Patch

The vulnerability is fixed in Grav CMS 2.0.13. The patched version updates the Flex Objects plugin to correctly parse and reject filenames expressed with array notation, ensuring that the actual extension (including those embedded in array-notation values) is checked against the blocklist.

Remediation

1. Upgrade Grav CMS to version 2.0.13 or later:

   bin/gpm self-upgrade
   bin/gpm update

   Copy

2. Audit uploaded files: Check the Grav user-data and uploads directories for unexpected .php or .phar files:

   find user/ -name "*.php" -o -name "*.phar" | grep -v "system\|vendor\|plugins\|themes"

   Copy

   Remove any suspicious files and investigate how they were placed.

3. Restrict admin panel access: Place the Grav admin at /admin behind a VPN, IP allowlist, or additional authentication layer. Exposing the admin panel to the public internet is not recommended regardless of CVE status.

4. Review user accounts: Ensure no unauthorized admin or editor accounts exist. Rotate all admin credentials as a precaution if exposure is suspected.

5. Disable Flex Objects if not in use:

   bin/gpm disable flex-objects

   Copy

Defence-in-Depth

Regardless of patching status, apply these server-level controls:

• Configure the web server to deny execution of PHP files in upload directories:

  # Nginx example
  location ~* /user/data/.*\.php$ {
      deny all;
  }

  Copy

• Ensure Grav's user/data/ and upload paths are not web-accessible for execution — serve them through a PHP handler that only delivers static content.

Context: Grav CMS Attack Surface

This is the third publicly disclosed critical-or-high severity vulnerability in the Grav ecosystem published in this batch (alongside CVE-2026-72822 and CVE-2026-72824 in the API plugin). Organizations running Grav-based sites should treat this week's advisories as a prompt to audit the full Grav installation — including core version, all installed plugins, and admin panel exposure — and apply all available patches.

References

• NVD — CVE-2026-72819
• Grav CMS — GitHub
• Flex Objects Plugin
• OWASP Unrestricted File Upload