CVE-2026-65008: Grav CMS RCE Vulnerability

CVE-2026-65008 Overview

CVE-2026-65008 is a remote code execution vulnerability in Grav CMS 2.0.4, fixed in version 2.0.7. The flaw resides in Blueprint::dynamicData() within system/src/Grav/Common/Data/Blueprint.php. The method passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this code path, an authenticated user holding the admin.pages or api.pages.write permission can embed a malicious callable directive in a page. The injected command executes as the web-server user each time any visitor — including unauthenticated users — loads the page.

Critical Impact
Authenticated attackers with page-write privileges can achieve pre-auth-triggerable code execution on the underlying web server, exposing full confidentiality, integrity, and availability of the host.

Affected Products

Grav CMS version 2.0.4
Grav CMS versions prior to 2.0.7
Grav installations with the form plugin enabled

Discovery Timeline

2026-07-21 - CVE-2026-65008 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65008

Vulnerability Analysis

Grav CMS stores page content and configuration as YAML frontmatter. The Blueprint::dynamicData() method processes dynamic directives embedded in this data. When a directive references a Class::method string, the method forwards that string and any accompanying arguments to PHP's call_user_func_array() without validating the target against an allowlist.

This behavior satisfies CWE-94: Improper Control of Generation of Code. The form plugin extends the attack surface by routing user-controlled page frontmatter through the same dynamic-data resolution path. As a result, callable directives planted in a page persist to disk and execute during page rendering.

The execution context is the web-server user account. Attackers can read filesystem contents, modify site data, pivot to adjacent services, or install web shells for durable access.

Root Cause

The root cause is missing input validation on callable strings resolved inside Blueprint::dynamicData(). Grav trusts the callable target implicitly and invokes it through call_user_func_array(). No allowlist restricts which classes or methods may be invoked, and no sandbox limits argument content.

Attack Vector

An authenticated user with admin.pages or api.pages.write permission edits a page and injects a malicious callable directive into the frontmatter. The payload is stored on disk with the page content. When any HTTP request reaches that page — authenticated or not — Grav parses the blueprint, resolves the dynamic directive, and executes the attacker-specified function with attacker-supplied arguments. The vulnerability is reachable over the network with low attack complexity.

Refer to the GitHub Security Advisory GHSA-fj2p-qj2f-74v5 and the VulnCheck Advisory on Grav for full technical detail.

Detection Methods for CVE-2026-65008

Indicators of Compromise

Page frontmatter or YAML files under user/pages/ containing unexpected Class::method callable directives referencing PHP internals such as system, exec, shell_exec, or passthru.
Unexpected child processes spawned by the PHP-FPM or web-server process (for example sh, bash, curl, wget, or python) during page rendering.
New or modified files under the Grav webroot with recent timestamps that were not produced by legitimate editors.
Outbound network connections initiated by the web-server user to attacker-controlled infrastructure.

Detection Strategies

Grep the user/pages/ tree for callable-style strings matching the pattern [A-Za-z_\\\\]+::[A-Za-z_]+ inside YAML frontmatter and flag anything referencing dangerous PHP functions.
Enable PHP audit logging or disable_functions telemetry to record invocations of call_user_func_array() with dynamic targets.
Correlate Grav admin authentication events with subsequent page-write API calls and unusual child-process activity on the host.

Monitoring Recommendations

Alert on any process tree where the web-server user (www-data, nginx, apache) parents a shell interpreter.
Monitor file integrity of user/pages/ and user/config/ directories and generate alerts on unauthorized writes.
Log and review all uses of the admin.pages and api.pages.write permissions and rotate credentials on any suspected compromise.

How to Mitigate CVE-2026-65008

Immediate Actions Required

Upgrade Grav CMS to version 2.0.7 or later on all instances.
Audit user/pages/ for suspicious callable directives inserted before the patch was applied and remove them.
Rotate admin credentials and API tokens with admin.pages or api.pages.write scope.
Review web-server and PHP logs since the upgrade window for evidence of exploitation.

Patch Information

The Grav maintainers fixed CVE-2026-65008 in version 2.0.7 by restricting the callable resolution inside Blueprint::dynamicData(). Administrators should follow the upgrade path described in the GitHub Security Advisory GHSA-fj2p-qj2f-74v5. Confirm the deployed version by running bin/grav --version after upgrade.

Workarounds

Restrict the admin.pages and api.pages.write permissions to a minimal set of trusted operators until the upgrade is completed.
Disable the form plugin on instances where it is not required to remove the exposed code path.
Place the Grav admin interface behind an authenticated reverse proxy or VPN to reduce exposure of the write-capable endpoints.

bash

# Configuration example: verify Grav version and disable form plugin as a temporary workaround
bin/grav --version
bin/gpm uninstall form
# Or disable via user/config/plugins/form.yaml
#   enabled: false