Deserialization of Untrusted Data in Grav CMS - #VU130081
Published: May 5, 2026
Vulnerability identifier: #VU130081
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in Session flash object handling when processing session data. A remote attacker can provide crafted serialized session content to execute arbitrary code.
Session storage is typically more restricted than the other deserialization vectors.
Affected software
Grav CMS
Remediation
Install security update from vendor's website.
Grav CMS - update to 2.0.0 beta.2