CVE-2026-75827: Grav before 2.0.15 Arbitrary File Write via error_log
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.15 - Compensating control
If you cannot immediately upgrade past Grav before 2.0.15, restrict access so that attackers cannot obtain page-edit or blueprint-config permissions, since those access levels can invoke error_log via a data directive to write PHP payloads to web-accessible files.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker must already have page-edit or blueprint-configuration access. The vulnerable dynamic-data handling can then be used to invoke error_log and append a PHP payload to a web-accessible file.
What can an attacker do after successful exploitation?
The described impact is remote code execution after the attacker writes a PHP payload into a web-accessible file. Exploitation does not require user interaction.
Which versions need to be remediated?
Upgrade Grav to 2.0.15 or later. The affected versions are Grav releases before 2.0.15.