CVE-2026-65008

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.4 through 2.0.6

Description Remote code execution is possible through the Blueprint::dynamicData() function in the system/src/Grav/Common/Data/Blueprint.php file. The issue occurs because a Class::method callable string and its arguments are passed directly to call user func array() without an allowlist. An authenticated user with admin.pages or api.pages.write permissions can insert a malicious callable directive into a page via the form plugin. This command then executes as the web-server user when any user, including unauthenticated visitors, accesses the affected page.

Recommendations Update Grav to version 2.0.7.