Remote Code Execution in Grav via Blueprint dynamicData

Grav CMS versions prior to 2.0.7 are susceptible to a remote code execution (RCE) vulnerability identified as CVE-2026-64850. The vulnerability stems from the Blueprint::dynamicData() method, which performs insufficient validation on class method inputs. Specifically, the application uses call_user_func_array() with input derived from page frontmatter without implementing an allowlist.

An attacker with admin.pages or api.pages.write permissions can craft a malicious page configuration that designates Grav\Common\Utils::arrayFilterRecursive as a callable to execute system-level commands. Because the frontmatter is processed when a page is rendered, the payload executes with the privileges of the web-server user whenever a visitor (including unauthenticated users) requests the page. This vulnerability effectively escalates a compromise of administrative page-editing rights to full system-level code execution on the underlying server.

Attack Chain

1. Attacker obtains valid admin.pages or api.pages.write permissions, likely via compromised administrative credentials.
2. Attacker logs into the Grav administrative interface and navigates to the page creation or editing module.
3. Attacker crafts a custom page containing malicious YAML frontmatter, specifically targeting the form plugin's field definitions.
4. Attacker inserts a data-opts@ directive into the frontmatter, pointing to Grav\Common\Utils::arrayFilterRecursive as the callable.
5. Attacker embeds the target system command (e.g., id) within the frontmatter payload, passing it as the primary argument to the function.
6. Attacker saves the page configuration to the Grav CMS data store.
7. Attacker (or any subsequent visitor) triggers a GET request to the path corresponding to the malicious page.
8. Grav CMS processes the page frontmatter, invokes the malicious callable via dynamicData(), and executes the command on the web server.

Impact

Successful exploitation results in arbitrary remote code execution on the host server under the context of the web-server user (e.g., www-data or apache). This allows for full system control, potential data exfiltration, or lateral movement within the hosting environment. Any user with page-editing privileges can turn a legitimate site into a persistent execution platform that triggers malicious commands upon every page view.

Recommendation

1. Upgrade all Grav CMS installations to version 2.0.7 or later to address the insecure call_user_func_array invocation in Blueprint.php.
2. Audit current administrative accounts for admin.pages or api.pages.write permissions to ensure they are restricted to authorized personnel only.
3. Implement monitoring for POST requests to the Grav admin interface followed by anomalous GET requests to newly created or modified pages that may indicate payload testing.
4. Review system-level web server logs for suspicious process execution (e.g., id, whoami, curl, wget) originating from the web server process user.