EUVD-2026-60591

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits errorlog, giving arbitrary file write...

PT-2026-76927

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error log function through a data directive...