PT-2026-61930 · Getgrav · Grav

Leonkaya + 2 · CVE-2026-65008 · Published 2026-07-21 · Updated 2026-07-21

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call user func array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-65008

Affected Products

Grav

References · 3

• https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65008 · Security Note
• https://vulncheck.com/advisories/grav-before-remote-code-execution-via-blueprint-dynamicdata · Note