EUVD-2026-107902

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

CVE-2026-114660

The Grav content management system (versions 2.0.0 before 2.2.5) is vulnerable to an improper access control issue in the FlexDirectory::dynamicFlexField() function. This flaw allows page authors to execute arbitrary Flex object methods using flex-*@ directives within page frontmatter. If a user ...