CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 Authenticated RCE Proof-of-concept for CVE-2026-65008 : authenticated remote code execution in Grav CMS via unrestricted calluserfuncarray in Blueprint::dynamicData. A user with admin.pages or api.pages.write can plant a malicious form frontmatter. The payload then...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-65008

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

CVE-2026-65008

Grav 2.0.4 contains a remote code execution vulnerability in Blueprint::dynamicData(), where a Class::method callable string and arguments are passed to call_user_func_array() without an allowlist. The form plugin routes page frontmatter through this path, allowing an authenticated user with admi...

CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...