CVE-2026-65008: Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to calluserfuncarray() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.7 - Compensating control
Restrict access to Grav pages/route rendering that uses the affected Form plugin behavior so that untrusted visitors do not trigger execution; use network controls such as firewall/ACL to limit who can access the vulnerable endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65008?
The severity of CVE-2026-65008 is critical with a score of 9.8.
How do I fix CVE-2026-65008?
To fix CVE-2026-65008, upgrade Grav to version 2.0.7 or later.
What type of vulnerability is CVE-2026-65008?
CVE-2026-65008 is a remote code execution vulnerability due to improper handling of class method callables.
Which versions of Grav are affected by CVE-2026-65008?
Grav versions prior to 2.0.7 are affected by CVE-2026-65008.
What can attackers do with CVE-2026-65008?
Attackers can exploit CVE-2026-65008 to execute arbitrary code on the server.