Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...