Grav < 2.0.7

A critical remote code execution vulnerability (CVE-2026-65008) in Grav versions prior to 2.0.7 allows an authenticated attacker with `admin.pages` or `api.pages.write` permissions to embed malicious callable directives in a page's frontmatter, leading to arbitrary code execution as the web-server user when the page is accessed.