EUVD-2026-307814

fkie_cve-2026-7317

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.

GHSA-gwfr-jfjf-92vv — Grav has Insecure Deserialization in File Cache

Affected: Packagist: getgrav/grav

# Insecure Deserialization in File Cache

- **Severity:** High - **CWE:** CWE-502 - **Location:** `system/src/Grav/Framework/Cache/Adapter/FileCache.php` - **Sink:** `unserialize($value, ['allowed_classes' => true])`

## Affected version(s)

- **Affected:** `>= 1.7.44` and `<= 1.7.49.5` (verified in current codebase and changelog-covered releases). - **Fixed:** No upstream fix identified in the reviewed branch at the time of analysis. - **Notes:** Earlier `1.7.x` releases may also be affected, but were not fully back-traced in this review.

## Notes `allowed_classes => true` allows object instantiation and does not constrain classes.

## PoC (Primitive Demonstration)

### Preconditions - Local PHP runtime. - Goal is to validate the deserialization primitive used in cache retrieval.

### Steps ```bash php -r ' class CacheWakeup { public function __wakeup(){ file_put_contents("/tmp/grav_filecache_poc.txt", "wakeup"); } }

$payload = serialize(new CacheWakeup()); unserialize($payload, ["allowed_classes" => true]);

echo file_exists("/tmp/grav_filecache_poc.txt") ? "FILECACHE_UNSERIALIZE_TRIGGERED\n" : "FILECACHE_UNSERIALIZE_NOT_TRIGGERED\n"; ' ```

### Expected Result - Output contains: `FILECACHE_UNSERIALIZE_TRIGGERED`.

### Interpretation This reproduces the same unsafe primitive used by `FileCache::doGet()`: `unserialize($value, ['allowed_classes' => true])`. If cache files are attacker-tampered, object magic methods may execute.

## Exploit Preconditions - Cache file poiso…

Most recent entries from all

EUVD-2026-307814

fkie_cve-2026-7317

GHSA-gwfr-jfjf-92vv — Grav has Insecure Deserialization in File Cache