CVE-2026-69088

Name of the Vulnerable Software and Affected Versions Grav CMS versions 2.0.7 through 2.0.10

Description Insufficient validation of fully-qualified static method calls (Class::method) in blueprint dynamic-field directives occurs because the Blueprint::isSafeDynamicCall() function only applies its dangerous-callable denylist to strings that do not contain '::'. An account with page-editing rights (admin.pages) can insert a directive in a page's form-field frontmatter to invoke arbitrary public static PHP methods with controlled arguments. This can lead to the disclosure of server-readable files to anonymous visitors and the arbitrary creation or copying of files and directories under the web-server account.

Recommendations Update Grav CMS to version 2.0.11.