CVE-2026-65608

Name of the Vulnerable Software and Affected Versions Grav versions 1.7.0 through 2.0.8

Description Authenticated users with create or update permissions on Flex-based directories, such as Flex Users, Flex Pages, Flex Objects, or custom Flex types, can execute arbitrary shell commands on the server. The issue occurs because the FlexDirectory::dynamicDataField() function resolves blueprint data-*@: directives by using call user func array() on input influenced by the user. While the system checks if the target is callable via is callable(), it fails to restrict dangerous functions like exec, system, passthru, or shell exec. This behavior bypasses previous validations implemented in Blueprint::dynamicData().

Recommendations Update Grav to version 2.0.9 or later.