CVE-2026-64850

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:24+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5...

CVE-2026-64850

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850

In Grav prior to 2.0.7, Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php passes an editor-controlled callable to call_user_func_array() without filtering dangerous callbacks. A user with admin.pages or api.pages.write privileges can use arrayFilterRecursive() as a trampoline ...