Deserialization of Untrusted Data in Grav CMS - #VU130079
Published: May 5, 2026
Vulnerability identifier: #VU130079
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in JobQueue reconstruction logic when processing a tampered serialized job payload. A remote attacker can supply a crafted serialized Job object to execute arbitrary code.
Exploitation does not require admin access if any file write primitive is available.
Affected software
Grav CMS
Remediation
Install security update from vendor's website.
Grav CMS - update to 2.0.0 beta.2