CVE-2026-75827

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.15

Description An arbitrary file write issue exists in the Blueprint dynamic-data bare-function validation due to the use of an incomplete denylist instead of a positive allowlist. Users with page-edit or blueprint-config access can trigger the error log() function via a data directive to append PHP payloads to web-accessible files, which can lead to remote code execution.

Recommendations Update Grav to version 2.0.15 or later.