Grav versions before 2.0.7 contain a code injection vulnerability (CWE-94) in the Blueprint::dynamicData() method located in system/src/Grav/Common/Data/Blueprint.php. This method unsafely passes an editor-controlled Class::method callback and arguments to PHP's call_user_func_array() without filtering dangerous callbacks. An attacker with admin.pages or api.pages.write permissions can leverage Grav\Common\Utils::arrayFilterRecursive() with the system callback to inject and execute arbitrary commands embedded in page frontmatter, running them as the web server user when the page is viewed. This issue was resolved in Grav version 2.0.7.

Successful exploitation allows an attacker with limited privileges (admin.pages or api.pages.write) to execute arbitrary code on the server with the web server's user privileges. This can lead to full system compromise depending on the server configuration. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. There are no known exploits in the wild at this time.

Upgrade Grav to version 2.0.7 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory stating the issue is fixed in 2.0.7.