Grav CMS Allowlist Bypass Enables Arbitrary Method Invocation

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Grav CMS versions 2.0.15 through 2.2.12 contain a critical allowlist bypass vulnerability that allows authenticated page editors to invoke arbitrary public static methods on the system. By exploiting data-*@ directives with unset-name@ or integer keys in Flex form overrides within page frontmatter, attackers can call dangerous methods like Folder::delete() or Utils::download() to delete directories, overwrite files, or exfiltrate sensitive data outside the intended page tree. This vulnerability is particularly concerning because it only requires page-edit permissions—a role that may be delegated to content contributors or less privileged users—making it a significant privilege escalation vector in multi-user CMS environments.

Casky's 351 matching skills leverage Claude AI with extended reasoning to map this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Discovery (TA0007) techniques. Practitioners using Casky would identify attack patterns including: suspicious Flex form configurations with non-standard data directives in page frontmatter; evidence of method reflection or dynamic invocation targeting filesystem or utility classes; and audit logs showing page editors triggering file operations inconsistent with normal content management. The platform's skill-driven analysis would flag the CWE-749 (Improper Restriction of Rendered UI Layers or Frames) weakness as a configuration control failure, helping security teams distinguish legitimate form customization from post-exploitation persistence mechanisms or data exfiltration attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116019.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-116019

Casky has 351 skills that investigate the attack patterns behind CVE-2026-116019. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn