PT-2026-61930 · Getgrav · Grav

Leonkaya + 2 · CVE-2026-65008 · Publicado 2026-07-21 · Atualizado 2026-07-21

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call user func array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-65008

Produtos afetados

Grav

Referências · 3

• https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-65008 · Nota de Segurança
• https://vulncheck.com/advisories/grav-before-remote-code-execution-via-blueprint-dynamicdata · Nota