CVE-2026-64850

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.7

Description In the Blueprint::dynamicData() function located in system/src/Grav/Common/Data/Blueprint.php, the software passes an editor-controlled Class::method provider and arguments to call user func array() without filtering dangerous callback parameters. An account possessing admin.pages or api.pages.write permissions can utilize GravCommonUtils::arrayFilterRecursive() as a trampoline with system as the callback. By placing a command in the page frontmatter, the attacker can execute that command as the web server user when the page is viewed.

Recommendations Update Grav to version 2.0.7.