Read the docs
TI-2026-06424 Aliases CVE-2026-7317GHSA-gwfr-jfjf-92vv

Grav CMS Cache Value FileCache.php doGet deserialization

Priority MEDIUM 45CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed CMS (Grav): 2.0.0-beta.2getgrav/grav (Packagist): 2.0.0-beta.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GravCMS1.7.49.0; 1.7.49.1; 1.7.49.2; 1.7.49.3; 1.7.49.4; 1.7.49.5; 2.0.0-beta.0; 2.0.0-beta.12.0.0-beta.2Patch availableCNA
—getgrav/grav (Packagist)before 2.0.0-beta.22.0.0-beta.2Patch availableGHSA-gwfr-jfjf-92vv
  • CMS VendorGrav Affected 1.7.49.0; 1.7.49.1; 1.7.49.2; 1.7.49.3; 1.7.49.4; 1.7.49.5; 2.0.0-beta.0; 2.0.0-beta.1 Fixed in 2.0.0-beta.2 Patch available CNA
  • getgrav/grav (Packagist) Vendor— Affected before 2.0.0-beta.2 Fixed in 2.0.0-beta.2 Patch available GHSA-gwfr-jfjf-92vv

Remediation

  • Fix · CNA CMS (Grav) Fixed in 2.0.0-beta.2
  • Fix · GHSA-gwfr-jfjf-92vv getgrav/grav (Packagist) Fixed in 2.0.0-beta.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7317
  2. 2026-10-03 Alias added: GHSA-gwfr-jfjf-92vv

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-40880 Grav - XML External Entity Injection via SVG Upload CVSS 4.0HIGH 7.1
  • TI-2026-42219 Grav - Arbitrary File Upload via Avatar Endpoint CVSS 4.0MEDIUM 5.3
  • TI-2026-10325 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation CVSS 4.0MEDIUM 5.1
  • TI-2026-42222 Grav - Stored CSS Injection via Markdown Image resize() Action CVSS 4.0MEDIUM 4.8
  • TI-2026-40879 Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences