CVE-2026-72819: Grav CMS Remote Code Execution via .zip File Upload
Summary
CVE-2026-72819: Grav CMS vulnerable to remote code execution via .zip file upload. Affects getgrav/grav versions < 2.0.13. Fixed in 2.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grav is a modern open-source flat-file content management system (CMS) that allows users to create and manage websites without the need for a traditional database. It is designed for speed and simplicity, utilizing a file-based architecture that makes it lightweight and easy to deploy. However, Grav has a vulnerability that allows a logged-in user to execute arbitrary commands on the server through a flaw in its file upload handling, specifically when processing .zip files.
Vulnerability Detail
The vulnerability arises from a failure in Grav's safety checks when handling routine names. The system is designed to reject dangerous routines and allow only a limited set of safe ones. However, when a routine is specified as a pair (component and routine), the safety check does not recognize it, allowing attackers to invoke any routine. This includes the routine that unpacks ZIP archives, which can lead to the execution of malicious PHP files uploaded within a ZIP file. The attacker can exploit this by uploading a ZIP file containing a PHP shell and then triggering the execution of that shell, resulting in remote code execution with the privileges of the web server.
How To Fix
Minimum fixed version
2.0.13
This is the first release that contains the fix.
composer require getgrav/grav:2.0.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict file uploads to only allow safe file types and implement server-side validation to check the contents of uploaded ZIP files. Additionally, consider disabling the ability for users to upload files altogether until the patch is applied.
Conclusion
CVE-2026-72819 is a critical vulnerability in Grav CMS that allows remote code execution via .zip file uploads. It is essential for users to update to the patched version (2.0.13 or later) to mitigate this risk. Until the update can be applied, users should implement workarounds to limit exposure to this vulnerability.
See every vulnerability recorded for getgrav/grav →
FAQ
CVE-2026-72819 is a vulnerability in Grav CMS that allows remote code execution through the upload of malicious .zip files.
Any instance of Grav CMS that allows logged-in users to upload files is potentially affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to complete server compromise, allowing attackers to execute arbitrary commands.
Yes, you can implement server-side validation for uploaded files and restrict file upload types as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for getgrav/grav.
