{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/grav--1.7.0--2.0.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-65608"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav (\u003e= 1.7.0, \u003c 2.0.9)"],"_cs_severities":["high"],"_cs_tags":["RCE","CMS","PHP","Grav","web-exploitation"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eGrav CMS versions 1.7.0 and later, up to but not including 2.0.9, are affected by a remote code execution (RCE) vulnerability identified as CVE-2026-65608. The flaw resides within the \u003ccode\u003eFlexDirectory::dynamicDataField()\u003c/code\u003e function, which is responsible for resolving \u003ccode\u003eblueprint data-*@:\u003c/code\u003e directives. This function improperly validates attacker-influenced input by using \u003ccode\u003ecall_user_func_array()\u003c/code\u003e without restricting dangerous PHP functions such as \u003ccode\u003eexec\u003c/code\u003e, \u003ccode\u003esystem\u003c/code\u003e, \u003ccode\u003epassthru\u003c/code\u003e, or \u003ccode\u003eshell_exec\u003c/code\u003e. This oversight bypasses existing validation mechanisms introduced in \u003ccode\u003eBlueprint::dynamicData()\u003c/code\u003e (CVE-2024-XXXX, GHSA-fj2p-qj2f-74v5). Any authenticated user possessing create or update permissions on a Flex-based directory, such as Flex Users, Flex Pages, Flex Objects, or custom Flex types, can exploit this vulnerability to execute arbitrary shell commands on the server, posing a critical risk to the integrity and availability of the Grav instance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An attacker obtains valid credentials for a Grav CMS user account that has \u0026quot;create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types).\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploitation Request\u003c/strong\u003e: The authenticated attacker crafts and sends an HTTP request to the Grav instance designed to create or update an entry within one of the vulnerable Flex-based directories.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePayload Injection\u003c/strong\u003e: Within the malicious HTTP request, the attacker embeds a payload disguised as a \u003ccode\u003eblueprint data-*@:\u003c/code\u003e directive, specifically crafted to call dangerous PHP functions like \u003ccode\u003eexec\u003c/code\u003e, \u003ccode\u003esystem\u003c/code\u003e, \u003ccode\u003epassthru\u003c/code\u003e, or \u003ccode\u003eshell_exec\u003c/code\u003e with arbitrary shell commands as arguments.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerable Function Call\u003c/strong\u003e: The Grav application processes the request. The \u003ccode\u003eFlexDirectory::dynamicDataField()\u003c/code\u003e function is invoked to resolve the attacker-controlled \u003ccode\u003eblueprint data-*@:\u003c/code\u003e directive.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eValidation Bypass\u003c/strong\u003e: \u003ccode\u003eFlexDirectory::dynamicDataField()\u003c/code\u003e performs a basic \u003ccode\u003eis_callable()\u003c/code\u003e check on the attacker-supplied function name but fails to prevent the invocation of dangerous functions, effectively bypassing the intended security validation.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand Execution\u003c/strong\u003e: The \u003ccode\u003ecall_user_func_array()\u003c/code\u003e PHP function is executed with the attacker-controlled dangerous function and arbitrary shell commands, leading to their execution on the server.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact\u003c/strong\u003e: The arbitrary shell commands are executed on the underlying server with the privileges of the web server process, granting the attacker remote code execution capabilities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65608 leads to authenticated remote code execution on the server hosting the Grav CMS instance. Attackers can execute arbitrary shell commands, potentially leading to full system compromise, data exfiltration, defacement, or the installation of further malware (e.g., web shells, backdoors). While no specific victim counts or targeted sectors are available, any organization utilizing affected Grav CMS versions with authenticated users could be at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch\u003c/strong\u003e: Immediately upgrade Grav CMS to version 2.0.9 or higher to remediate CVE-2026-65608.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor Process Creation\u003c/strong\u003e: Deploy the Sigma rules \u0026quot;Detect Grav CVE-2026-65608 Exploitation - Linux Web Server Spawning Shell\u0026quot; and \u0026quot;Detect Grav CVE-2026-65608 Exploitation - Windows Web Server Spawning Shell\u0026quot; to your SIEM to detect suspicious process creations originating from web server processes, which could indicate successful exploitation.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Permissions\u003c/strong\u003e: Audit Grav CMS user permissions, especially those related to creating or updating Flex-based directories, ensuring the principle of least privilege is applied.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eWeb Application Firewall\u003c/strong\u003e: Implement or update WAF rules to detect and block suspicious requests targeting Grav CMS endpoints that modify Flex directory entries, looking for shell command metacharacters or dangerous function calls in request bodies.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T12:21:42Z","date_published":"2026-07-23T12:21:42Z","id":"https://feed.craftedsignal.io/briefs/2026-07-grav-rce/","summary":"An authenticated remote code execution vulnerability (CVE-2026-65608) in Grav CMS versions 1.7.0 through 2.0.8 allows attackers with Flex directory create/update permissions to execute arbitrary shell commands due to improper input validation in `FlexDirectory::dynamicDataField()`.","title":"Grav CMS Remote Code Execution Vulnerability (CVE-2026-65608)","url":"https://feed.craftedsignal.io/briefs/2026-07-grav-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav (\u003e= 1.7.0, \u003c 2.0.9)","version":"https://jsonfeed.org/version/1.1"}