Grav before version 2.0.15 has an arbitrary file write vulnerability in its Blueprint dynamic-data bare-function validation. The vulnerability arises because the validation uses an incomplete denylist rather than a positive allowlist. Attackers with page-edit or blueprint-config permissions can exploit this flaw to invoke the error_log function via a data directive, allowing them to append PHP payloads to web-accessible files and potentially achieve remote code execution.