Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck

CVE-2026-65008Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

Critical 9.8

In plain English

A critical-severity code injection in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.5%top 15.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	2.0.7	GHSA-fj2p-qj2f-74v5

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.7

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-fj2p-qj2f-74v5) vendor-advisory
VulnCheck Advisory: Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData third-party-advisory