{"id":"GHSA-wvxr-6v52-gfmh","title":"Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS","summary":"Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS","severity":"high","cvss":8.8,"cwe":["CWE-94"],"vendor":"getgrav","product":"getgrav/grav","ecosystem":"composer","affected":["getgrav/grav < 2.0.13"],"published":"2026-08-14","updated":"2026-09-17","sourceUpdated":"2026-09-17T20:56:30Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wvxr-6v52-gfmh","references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72819"},{"url":"https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-zip-upload"},{"url":"https://github.com/advisories/GHSA-wvxr-6v52-gfmh"}],"tags":["ghsa","composer"],"ingestedAt":"2026-09-17T21:29:16.993Z","slug":"GHSA-wvxr-6v52-gfmh","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-r94f-hx44-8jqf. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.\n\n## Affected packages\n\n- `getgrav/grav < 2.0.13`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}