Grav CMS versions 2.0.7 to 2.0.10 fail to properly validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because the denylist in Blueprint::isSafeDynamicCall() does not apply to strings containing '::'. This allows an attacker with page-editing privileges (but not full admin) to plant a directive in a page's form-field frontmatter that executes arbitrary public static PHP methods with attacker-controlled arguments. Exploitation can lead to reading any file accessible by the server and arbitrary creation or copying of files and directories under the web server account. The issue is resolved in version 2.0.11.

An attacker with limited privileges (page-editing rights) can perform code injection to execute arbitrary static PHP methods, leading to disclosure of any server-readable file to anonymous visitors and arbitrary file system modifications under the web server account. This elevates the attacker's capabilities beyond their assigned privileges and can compromise confidentiality and integrity of the server environment.

This vulnerability is fixed in Grav CMS version 2.0.11. Users should upgrade to version 2.0.11 or later to remediate this issue. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.