PT-2026-67410 · Getgrav · Grav

Adamyordan · CVE-2026-69088 · Published 2026-08-03 · Updated 2026-08-03

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-69088

Affected Products

Grav

References · 3

• https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-69088 · Security Note
• https://vulncheck.com/advisories/grav-cms-through-arbitrary-method-invocation-via-blueprint · Note