CVE-2026-7317
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was found in Grav CMS up to version 1.7.49.5/2.0.0-beta.1 in the FileCache::doGet function of the Cache Value Handler component, leading to deserialization. The attack can be launched remotely but requires high complexity and is difficult to exploit. The exploit has been made public. Upgrading to version 2.0.0-beta.2 addresses the issue.
Risk Assessment
The risk involves potential remote code execution via deserialization, which could lead to system compromise, although exploitation is difficult.
Recommendation
It is recommended to upgrade to version 2.0.0-beta.2 or later.
Original NVD description (English source)
A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.