CVE-2026-65008

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5
https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-blueprint-dynamicdata
https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Grav 2.0.4 (corregido en 2.0.7) contiene una vulnerabilidad de ejecución remota de código en Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), que pasa una cadena invocable Class::method y sus argumentos directamente a call_user_func_array() sin ninguna lista de permitidos. Debido a que el plugin de formulario enruta el frontmatter de la página a través de esta ruta, una cuenta autenticada con el permiso admin.pages (o api.pages.write) puede insertar una directiva invocable maliciosa en una página. El comando se ejecuta entonces como el usuario del servidor web cada vez que alguien -incluido un visitante no autenticado- accede a la página.

Information

Published : 2026-07-21 12:19

Updated : 2026-10-24 20:10

NVD link : CVE-2026-65008

Mitre link : CVE-2026-65008

CVE.ORG link : CVE-2026-65008

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-65008", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65008", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T14:20:32.223632Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.7", "versionType": "semver"}], "packageURL": "pkg:composer/getgrav/grav", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T12:19:01.183", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-blueprint-dynamicdata", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone \u2014 including an unauthenticated visitor \u2014 accesses the page."}, {"lang": "es", "value": "Grav 2.0.4 (corregido en 2.0.7) contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), que pasa una cadena invocable Class::method y sus argumentos directamente a call_user_func_array() sin ninguna lista de permitidos. Debido a que el plugin de formulario enruta el frontmatter de la p\u00e1gina a trav\u00e9s de esta ruta, una cuenta autenticada con el permiso admin.pages (o api.pages.write) puede insertar una directiva invocable maliciosa en una p\u00e1gina. El comando se ejecuta entonces como el usuario del servidor web cada vez que alguien -incluido un visitante no autenticado- accede a la p\u00e1gina."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "disclosure@vulncheck.com"}