What is CVE-2026-114660?

CVE-2026-114660 is a medium-severity vulnerability in Getgrav Grav, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 6.3/10. Published 2026-10-22.

How severe is CVE-2026-114660?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Getgrav Grav

CVE-2026-114660

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.

Published 2026-10-22 · last modified 2026-10-22.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Getgrav Grav

Weakness classification (CWE)

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)

References

github.com/getgrav/grav/security/advisories/GHSA-95jr-q4xh-27vr (vendor-advisory)
www.vulncheck.com/advisories/grav-2.0.0-before-2.2.5-unauthorized-page-deletion… (third-party-advisory)

Frequently asked questions

What is CVE-2026-114660?: CVE-2026-114660 is a medium-severity vulnerability in Getgrav Grav, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 6.3/10. Published 2026-10-22.
How severe is CVE-2026-114660?: Medium severity. CVSS v3 base score is 6.3 out of 10.