Attack Chain

1. Initial Access: An attacker obtains valid credentials for a Grav CMS user account that has "create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types)."
2. Exploitation Request: The authenticated attacker crafts and sends an HTTP request to the Grav instance designed to create or update an entry within one of the vulnerable Flex-based directories.
3. Payload Injection: Within the malicious HTTP request, the attacker embeds a payload disguised as a blueprint data-*@: directive, specifically crafted to call dangerous PHP functions like exec, system, passthru, or shell_exec with arbitrary shell commands as arguments.
4. Vulnerable Function Call: The Grav application processes the request. The FlexDirectory::dynamicDataField() function is invoked to resolve the attacker-controlled blueprint data-*@: directive.
5. Validation Bypass: FlexDirectory::dynamicDataField() performs a basic is_callable() check on the attacker-supplied function name but fails to prevent the invocation of dangerous functions, effectively bypassing the intended security validation.
6. Command Execution: The call_user_func_array() PHP function is executed with the attacker-controlled dangerous function and arbitrary shell commands, leading to their execution on the server.
7. Impact: The arbitrary shell commands are executed on the underlying server with the privileges of the web server process, granting the attacker remote code execution capabilities.

Impact

Successful exploitation of CVE-2026-65608 leads to authenticated remote code execution on the server hosting the Grav CMS instance. Attackers can execute arbitrary shell commands, potentially leading to full system compromise, data exfiltration, defacement, or the installation of further malware (e.g., web shells, backdoors). While no specific victim counts or targeted sectors are available, any organization utilizing affected Grav CMS versions with authenticated users could be at risk.

Recommendation

• Patch: Immediately upgrade Grav CMS to version 2.0.9 or higher to remediate CVE-2026-65608.
• Monitor Process Creation: Deploy the Sigma rules "Detect Grav CVE-2026-65608 Exploitation - Linux Web Server Spawning Shell" and "Detect Grav CVE-2026-65608 Exploitation - Windows Web Server Spawning Shell" to your SIEM to detect suspicious process creations originating from web server processes, which could indicate successful exploitation.
• Review Permissions: Audit Grav CMS user permissions, especially those related to creating or updating Flex-based directories, ensuring the principle of least privilege is applied.
• Web Application Firewall: Implement or update WAF rules to detect and block suspicious requests targeting Grav CMS endpoints that modify Flex directory entries, looking for shell command metacharacters or dangerous function calls in request bodies.