Description

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T12:16:44.873Z",
  "pubdate": "2026-08-14T12:16:44.873Z",
  "executiveSummary": "Grav CMS before 2.0.13 suffers from a remote code execution vulnerability residing within the Flex Objects plugin settings validation mechanism. The flaw allows authenticated users with specific privileges to execute arbitrary PHP code on the underlying operating system.\nThe root of the issue lies in improper input validation and type handling during routine name verification, which attackers can manipulate using array notation rather than standard string notation. This circumvents security controls and enables unauthorized invocation of the unZip routine.\nSuccessful exploitation results in the deployment and extraction of a malicious ZIP archive containing executable PHP payloads directly into the web root. This grants the attacker complete remote code execution capabilities, compromising the integrity, confidentiality, and availability of the affected system.\nThe attack requires authentication within the administrative interface, though the exact privilege level is dictated by the ability to interact with the Flex Objects plugin settings. Remediation requires updating Grav CMS to version 2.0.13 or later where the input validation flaw is properly addressed.",
  "technicalDetails": "The vulnerability exists in the Flex Objects plugin settings validation component of Grav CMS prior to version 2.0.13. The affected component fails to rigorously validate and sanitize routine names supplied during settings validation routines, introducing a critical flaw in input handling.\nSpecifically, the input validation logic is susceptible to a type juggling or parsing discrepancy where string notation is expected, but array notation is processed. An authenticated attacker leverages this behavioral quirk to bypass routine name validation checks entirely.\nBy supplying maliciously crafted array parameters instead of standard strings, the attacker can coerce the application into invoking internal functions that were not intended to be exposed during the validation phase, most notably the unZip routine.\nThe exploitation flow proceeds as follows: First, the authenticated attacker uploads a specially crafted ZIP archive containing malicious PHP code via the application interface. Second, the attacker interacts with the Flex Objects plugin settings, supplying input structured with array notation to bypass routine name restrictions.\nThird, the manipulated input successfully triggers the unZip routine, which processes the uploaded malicious archive without adequate path traversal or file type restrictions. Fourth, the unZip routine extracts the contents of the archive, writing arbitrary PHP payload files directly into the web root of the server.\nFinally, the attacker initiates HTTP requests to the newly written PHP files residing in the web root, causing the web server to execute the arbitrary code under the privileges of the web application user, leading to full system compromise."
}