CVE-2026-56700Critical· 9.8▾ MidnightGrav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.5%
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, InstallCommand's git clone operation passes the branch, url, and path parameters into a shell command without escaping, allowing OS command injection via plugin/theme installation (which requires admin access). A Twig security blocklist bypass (server-side template injection) is also present. The issues are fixed in 2.0.0-beta.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117604High· 7.5Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
CVE-2026-116019High· 8.8Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
CVE-2026-114657Medium· 5.7Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
CVE-2026-114660Medium· 6.3Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
CVE-2026-112782High· 7.5Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
CVE-2026-112780High· 8.8Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@