Arbitrary Static Method Execution in Grav CMS

Grav CMS versions 2.0.7 through 2.0.10 are vulnerable to an arbitrary static method execution flaw (CVE-2026-69088). The vulnerability stems from insufficient input validation in the Blueprint::isSafeDynamicCall() function. While the application implements a denylist for dangerous callables, this protection is bypassed when a fully-qualified static method call (using the Class::method syntax) is utilized, as the validation check fails to evaluate strings containing the double-colon delimiter.

An attacker with administrative page-editing access (admin.pages) can inject a malicious directive into the form-field frontmatter of a page. When the application parses this blueprint, it executes the specified static method. By leveraging existing gadget methods within the PHP environment, an attacker can read arbitrary files accessible to the web server user or perform file/directory creation and modification. This effectively elevates privileges for a low-privileged editor to perform sensitive system operations. The issue is resolved in Grav CMS version 2.0.11.

Impact

Successful exploitation allows an attacker to read any file on the server readable by the web server process and perform unauthorized file and directory operations. This can lead to the exfiltration of sensitive configuration files, source code, or internal data, as well as the modification of the web root to achieve persistent code execution. This vulnerability is particularly critical in multi-user environments where page-editing permissions are delegated to non-administrative users.

Recommendation

1. Upgrade all instances of Grav CMS to version 2.0.11 or later immediately to patch CVE-2026-69088.
2. Review system logs for unexpected modification of configuration files or directory structures within the web root.
3. Audit administrative user accounts to ensure that page-editing privileges are granted only to trusted personnel.
4. Restrict file system permissions for the web server user to the minimum necessary to function, specifically limiting write access to only required directories, to mitigate the impact of arbitrary file operations.