A high-severity (CVSS 8.8) flaw in Grav CMS lets an authenticated user with page-editing rights plant a malicious callable in a page, executing arbitrary code as the web-server user when anyone views it.
What Is It
CVE-2026-65008 is a remote code execution vulnerability (CWE-94, code injection) in Grav 2.0.4. The flaw lives in Blueprint::dynamicData() within system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to call_user_func_array() with no allowlist. Because the form plugin routes page frontmatter through this code path, an attacker can smuggle a malicious callable directive into a page.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 8.8 (HIGH), with a network attack vector, low complexity, low privileges required, and no user interaction. An authenticated account holding the admin.pages (or api.pages.write) permission can plant the payload once; the injected command then executes as the web-server user whenever anyone, including an unauthenticated visitor; accesses the affected page. This turns a single authenticated write into persistent server-side code execution triggerable by arbitrary traffic.
What's Vulnerable
- Vendor/Product: getgrav / Grav
- Affected: all versions prior to 2.0.7 (e.g., 2.0.4)
- Not affected: 2.0.7 and later
Patch Status
The vulnerability is fixed in Grav 2.0.7. Administrators running any version below 2.0.7 should upgrade to 2.0.7 or later. There is no CISA KEV entry supplied for this CVE, so active exploitation is not confirmed in the provided source material.