Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...

EUVD-2026-48244

Grav: FlexDirectory::dynamicDataField executes arbitrary callables from blueprint data with no validation...

GHSA-C4WF-2XXC-68QM Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...

Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c4wf-2xxc-68qm. This link is maintained to preserve external references. Original Description Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

CVE-2026-65608

Grav prior to 2.0.9 is vulnerable to remote code execution via FlexDirectory. The flaw in FlexDirectory::dynamicDataField() uses attacker-influenced input with call_user_func_array() and only validates that the target is callable, allowing arbitrary shell commands when an authenticated user with ...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...