CVE-2026-65008: Improper Control of Generation of Code ('Code Injection') in getgrav grav
Description
Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.
CVSS v4.0
Score 9.3critical
Affected software
getgrav
grav
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-65008 is a remote code execution vulnerability in Grav 2.0.4 caused by improper control of code generation in the Blueprint::dynamicData() method. This method passes a Class::method callable string and its arguments directly to call_user_func_array() without an allowlist, enabling an authenticated user with specific permissions to plant malicious callable directives in page frontmatter. These directives execute as the web-server user when the page is accessed, potentially compromising the server. The issue is resolved in version 2.0.7.
Potential Impact
An attacker with authenticated access and admin.pages or api.pages.write permissions can execute arbitrary code on the server with web-server privileges by injecting malicious callable code into a page. This can lead to full server compromise when the page is accessed by any user, including unauthenticated visitors.
Mitigation Recommendations
Upgrade Grav to version 2.0.7 or later, where this vulnerability is fixed. Until the upgrade is applied, restrict access to accounts with admin.pages or api.pages.write permissions to trusted users only. Patch status is not explicitly confirmed in the vendor advisory, but the vulnerability is fixed in 2.0.7 according to the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-21T11:32:54.897Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Indicators of Compromise
Exploit Source Code
Exploit code for Grav CMS 2.0.7 - RCE
#!/usr/bin/env python3 # Exploit Title: Grav CMS 2.0.7 - Remote Code Execution # Date: 2026-07-27 # Exploit Author: zer0dayf # Vendor Homepage: https://getgrav.org/ # Software Link: https://github.com/getgrav/grav # Version: Grav CMS < 2.0.7 # Tested on: Ubuntu 22.04 / PHP 8.2 # CVE : CVE-2026-65008 """ CVE-2026-65008 - Grav CMS < 2.0.7 Authenticated RCE via Blueprint::dynamicData() + arrayFilterRecursive trampoline Lab / authorized testing only. """ import argparse import re import sys imp... (6638 more characters)
Threat ID: 6a5f622e2a4a8d598918bded
Added to database: 07/21/2026, 12:12:30 UTC
Last enriched: 07/30/2026, 11:23:42 UTC
Last updated: 10/19/2026, 06:48:18 UTC
Views: 113
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.