CVE-2026-65608

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

PT-2026-63974

Name of the Vulnerable Software and Affected Versions Grav versions 1.7.0 through 2.0.8 Description Authenticated users with create or update permissions on Flex-based directories, such as Flex Users, Flex Pages, Flex Objects, or custom Flex types, can execute arbitrary shell commands on the...