CVE-2026-75827 describes a critical code injection vulnerability in Grav CMS prior to version 2.0.15. The vulnerability arises from the use of an incomplete denylist rather than a positive allowlist in the Blueprint dynamic-data bare-function validation. This enables attackers who have page-edit or blueprint-config privileges to invoke the PHP error_log function through crafted data directives, resulting in arbitrary file writes to web-accessible locations and potential remote code execution.

Successful exploitation allows remote code execution by appending malicious PHP code to files accessible via the web, compromising the affected system. The vulnerability requires the attacker to have page-edit or blueprint-config access, which may limit the attack surface but still represents a critical risk if such access is obtained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict page-edit and blueprint-config access to trusted users only and monitor for suspicious activity involving file writes or error_log usage.