CVE-2026-65008 is a remote code execution vulnerability in Grav CMS 2.0.4, specifically in the Blueprint::dynamicData() method. The method improperly controls code generation by passing a Class::method callable string and its arguments directly to call_user_func_array() without an allowlist. Because the form plugin routes page frontmatter through this method, an authenticated user with admin.pages or api.pages.write permissions can inject a malicious callable directive into a page. This directive executes as the web server user whenever the page is accessed, including by unauthenticated visitors. The vulnerability is addressed in Grav 2.0.7.

An attacker with authenticated access and specific permissions can achieve remote code execution on the server hosting Grav CMS 2.0.4. This allows execution of arbitrary code with the privileges of the web server user, potentially leading to full system compromise. The vulnerability can be triggered by any visitor accessing the maliciously crafted page, increasing the risk of widespread exploitation.

Upgrade Grav CMS to version 2.0.7 or later, where this vulnerability is fixed. Since no official vendor advisory or patch link is provided, verify the upgrade through the official Grav project channels. Until patched, restrict permissions to admin.pages and api.pages.write to trusted users only to reduce risk.