Grav Remote Code Execution Vulnerability in Blueprint::dynamicData()

A critical remote code execution (RCE) vulnerability, identified as CVE-2026-65008, has been discovered in Grav versions prior to 2.0.7. The flaw resides within the Blueprint::dynamicData() function in system/src/Grav/Common/Data/Blueprint.php, which unsafely passes a Class::method callable string and its arguments directly to PHP's call_user_func_array() without proper validation or an allowlist. This oversight enables an authenticated attacker with admin.pages or api.pages.write permissions to inject a malicious callable directive into a page's frontmatter. Subsequently, when any user, including unauthenticated visitors, accesses the compromised page, the embedded malicious command executes on the web server with the privileges of the web-server user, allowing for arbitrary code execution.

Attack Chain

1. An attacker gains authenticated access to a Grav installation with admin.pages or api.pages.write permissions.
2. The attacker accesses the Grav administration panel to create or modify an existing page.
3. The attacker embeds a malicious PHP callable string, such as system('command') or exec('command'), within the page's frontmatter definition.
4. The Grav application processes and stores the crafted page content, including the malicious callable directive.
5. Any user, whether authenticated or unauthenticated, navigates to and accesses the compromised Grav page via the web server.
6. During page rendering, the vulnerable Blueprint::dynamicData() function processes the page's frontmatter.
7. The function passes the attacker-controlled callable string and its arguments directly to call_user_func_array() without any sanitization or validation.
8. The malicious PHP code executes on the underlying web server with the privileges of the web-server user, granting the attacker arbitrary remote code execution capabilities.

Impact

Successful exploitation of CVE-2026-65008 results in arbitrary remote code execution on the Grav host, with the privileges of the web-server user. This critical vulnerability (CVSS v3.1 Base Score: 9.8) grants attackers full control over the compromised Grav instance and potentially the underlying server. Impact could include website defacement, data exfiltration, installation of backdoors, further network penetration, or use of the server for malicious activities such as hosting malware or launching attacks. While no specific victim numbers or targeted sectors are detailed, any organization using affected Grav versions is at severe risk.

Recommendation

• Patch Grav to version 2.0.7 or later immediately to remediate CVE-2026-65008.
• Regularly review user permissions in Grav, especially those with admin.pages or api.pages.write, to ensure the principle of least privilege is strictly enforced.
• Monitor web server access logs for unusual POST or PUT requests to Grav administration endpoints that create or modify page content, looking for suspicious embedded callable functions.