CVE-2026-65608 is a remote code execution vulnerability in Grav CMS affecting versions >=1.7.0 and <2.0.9. The vulnerability exists because FlexDirectory::dynamicDataField() uses call_user_func_array() on attacker-controlled input to resolve blueprint data-*@: directives, validating only that the target is callable but not restricting dangerous functions such as exec, system, passthru, or shell_exec. Since FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in version 2.0.7. Any authenticated user with create or update permissions on Flex-based directories can exploit this to execute arbitrary shell commands on the server.

An attacker with authenticated access and create or update permissions on any Flex-based directory can execute arbitrary shell commands on the server, leading to full remote code execution. This can compromise the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent unauthorized create or update actions on Flex-based directories. Monitor vendor channels for updates and apply patches promptly once released.