Haftoe

**Name of the Vulnerable Software and Affected Versions** Grav versions 1.7.0 through 2.0.8 **Description** Authenticated users with create or update permissions on Flex-based directories, such as Flex Users, Flex Pages, Flex Objects, or custom Flex types, can execute arbitrary shell commands on the server. The issue occurs because the `FlexDirectory::dynamicDataField()` function resolves blueprint `data-*@:` directives by using `call user func array()` on input influenced by the user. While the system checks if the target is callable via `is callable()`, it fails to restrict dangerous functions like `exec`, `system`, `passthru`, or `shell exec`. This behavior bypasses previous validations implemented in `Blueprint::dynamicData()`. **Recommendations** Update Grav to version 2.0.9 or later.