High severity8.8NVD Advisory· Published Aug 14, 2026· Updated Sep 8, 2026

CVE-2026-72819

Description

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grav CMS/Flex Objectsllm-fuzzy
Range: <2.0.13
Getgrav/Gravllm-fuzzy
Range: <2.0.13

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-r94f-hx44-8jqfghsaADVISORY
github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqfnvd
nvd.nist.gov/vuln/detail/CVE-2026-72819ghsa
www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-zip-uploadnvd

News mentions

Grav CMS: Eleven Vulnerabilities Disclosed, Including Critical API Privilege Escalation
Vypr Intelligence · Aug 14, 2026

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000