PT-2026-35830 · Grav Cms · Grav Cms

S4Nnty · Published 2026-04-28 · Updated 2026-05-05 · CVE-2026-7317

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Grav CMS versions 1.7.44 through 2.0.0-beta.1

Description An insecure deserialization issue exists in the Cache Value Handler component. The doGet() function within the system/src/Grav/Framework/Cache/Adapter/FileCache.php file uses unserialize() with the allowed classes option set to true, which allows for unrestricted object instantiation. If an attacker can poison or tamper with cache files, they may be able to execute object magic methods remotely. Deserialization is the process of converting a stored data format back into an object in memory.

Recommendations Update Grav CMS to version 2.0.0-beta.2. As a temporary workaround, restrict write access to the cache directories to prevent unauthorized tampering with cache files.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2026-7317

GHSA-GWFR-JFJF-92VV

GHSA-J7RW-325J-2RMX

Affected Products

Grav Cms

References · 11

• 🔥 https://github.com/devsamuelsantiago/grav-cms-filecache-object-injection · Exploit
• https://github.com/getgrav/grav/commit/c66dfeb5f · Patch
• https://osv.dev/vulnerability/GHSA-gwfr-jfjf-92vv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7317 · Security Note
• https://osv.dev/vulnerability/GHSA-j7rw-325j-2rmx · Vendor Advisory
• https://github.com/getgrav/grav/security/advisories/GHSA-gwfr-jfjf-92vv · Note
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 · Note
• https://vuldb.com/vuln/359965/cti · Note
• https://vuldb.com/submit/798732 · Note
• https://vuldb.com/vuln/359965 · Note