Matihub25

**Name of the Vulnerable Software and Affected Versions** Grav versions 2.0.4 through 2.0.6 **Description** Remote code execution is possible through the `Blueprint::dynamicData()` function in the `system/src/Grav/Common/Data/Blueprint.php` file. The issue occurs because a `Class::method` callable string and its arguments are passed directly to `call user func array()` without an allowlist. An authenticated user with `admin.pages` or `api.pages.write` permissions can insert a malicious callable directive into a page via the form plugin. This command then executes as the web-server user when any user, including unauthenticated visitors, accesses the affected page. **Recommendations** Update Grav to version 2.0.7.