CVE-2026-112780 | getgrav Grav up to 2.2.1 Flex Form Fields download replace-name permission

October 19, 2026 Yanac

A vulnerability classified as critical has been found in getgrav Grav up to 2.2.1. This impacts the function Folder::delete/Folder::move/Utils::download of the component Flex Form Fields. The manipulation of the argument replace-name leads to permission issues.

This vulnerability is traded as CVE-2026-112780. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More