CVE-2026-65008
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData(). The function passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command executes as the web-server user whenever anyone – including an unauthenticated visitor – accesses the page.
Risk Assessment
An attacker with a low-privileged account can gain full control over the web server by executing arbitrary code. This can lead to data theft, content modification, or further attacks on the infrastructure.
Recommendation
Immediately upgrade Grav to version 2.0.7 or later. Also restrict admin.pages and api.pages.write permissions to trusted users only.
Original NVD description (English source)
Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.