CVE-2026-64850: Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated account with either the admin.pages permission or the api.pages.write permission can exploit it. The attacker needs the ability to control page frontmatter and have the affected page viewed.
What access does successful exploitation provide?
The injected command executes as the web server user. The impact therefore depends on the permissions available to that user on the host.
Which versions are affected and what is the fix?
Grav versions prior to 2.0.7 are affected. Upgrade to version 2.0.7, which fixes the unsafe callback handling in Blueprint::dynamicData().
How can I assess whether exploitation may already have occurred?
Review page frontmatter for unexpected command content and investigate pages modified by accounts with admin.pages or api.pages.write. Also review web server activity for commands executed when affected pages were viewed.