CVE-2026-75827: Grav CMS Arbitrary File Write RCE Vulnerability

CVE-2026-75827 Overview

CVE-2026-75827 is an arbitrary file write vulnerability in Grav flat-file content management system (CMS) versions before 2.0.15. The flaw resides in the Blueprint dynamic-data bare-function validation, which relies on an incomplete denylist rather than a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the PHP error_log function through a data directive. This allows appending arbitrary PHP payloads to web-accessible files, resulting in remote code execution (RCE). The weakness is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated users with page-edit or blueprint-config privileges can achieve remote code execution on the host by writing PHP payloads to web-accessible files.

Affected Products

Grav CMS versions prior to 2.0.15
Grav Blueprint dynamic-data validation component
Deployments exposing page-edit or blueprint-config functionality to untrusted users

Discovery Timeline

2026-08-18 - CVE-2026-75827 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75827

Vulnerability Analysis

Grav uses Blueprints to define form schemas and dynamic data behavior for pages and configuration objects. Dynamic-data directives allow certain PHP callables to populate field values at render time. To restrict which functions can be invoked, Grav applied a denylist of dangerous callables. The denylist did not include error_log, which accepts a message, a destination type, and a file path. Attackers supply message type 3, causing PHP to append the attacker-controlled message directly to a file of their choosing. The resulting write requires no template escaping or filter bypass and preserves attacker-supplied bytes verbatim.

Root Cause

The root cause is the use of an incomplete denylist instead of a positive allowlist in the bare-function validation logic. Denylists inherently fail when the language exposes many functions with file-writing side effects. Because error_log was not enumerated as dangerous, the validator accepted it as a permitted callable inside a data directive.

Attack Vector

Exploitation requires an authenticated account with page-edit or blueprint-config access. The attacker crafts a Blueprint or page frontmatter containing a data directive that invokes error_log with a PHP payload and a target path under the Grav web root. Rendering or saving the page triggers the write. A subsequent HTTP request to the written .php file executes the payload in the web server context, granting remote code execution.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-f8wv-xp27-6gq7 and the VulnCheck Advisory on Grav for additional technical context.

Detection Methods for CVE-2026-75827

Indicators of Compromise

Unexpected .php, .phtml, or .phar files under the Grav user/pages/, user/data/, or web root directories.
Modified timestamps on writable directories that correlate with page-save or blueprint-save events.
Blueprint YAML or page frontmatter containing error_log references inside data, data-default@, or similar dynamic directives.
Outbound network connections from the PHP-FPM or web server process to attacker infrastructure following a page edit.

Detection Strategies

Audit Grav admin activity logs for page or blueprint saves performed by non-administrative accounts.
Scan Blueprint files and page frontmatter for the string error_log inside data directives.
Monitor for new PHP files created by the web server user under document-root directories after CMS activity.
Compare deployed Grav plugin and theme Blueprint files against upstream hashes to detect tampering.

Monitoring Recommendations

Enable file integrity monitoring on the Grav installation root and the user/ tree.
Forward web server and PHP error logs to a central location and alert on process spawns from PHP such as sh, bash, curl, or wget.
Alert on HTTP requests to newly created .php files that were not present in the last known-good deployment.

How to Mitigate CVE-2026-75827

Immediate Actions Required

Upgrade Grav to version 2.0.15 or later on all production and staging instances.
Rotate admin credentials and API tokens for any Grav account that could edit pages or blueprints.
Review page and blueprint content for unauthorized error_log directives and remove any attacker-created PHP files under the web root.
Restrict page-edit and blueprint-config permissions to trusted administrators only.

Patch Information

The fix is included in Grav 2.0.15. According to the GitHub Security Advisory, the maintainers replaced the incomplete denylist with a positive allowlist for bare functions permitted in dynamic-data validation. Administrators should apply the upstream release rather than back-porting individual changes.

Workarounds

Restrict access to the Grav admin interface using network controls such as VPN or IP allowlists until patching is complete.
Remove or downgrade user accounts that hold page-edit or blueprint-config privileges but do not require them.
Configure the web server to deny PHP execution in user-uploadable directories where feasible.
Deploy a web application firewall (WAF) rule to inspect admin form submissions for error_log strings inside YAML directives.

bash

# Configuration example: verify Grav version and locate suspicious blueprints
cd /var/www/grav
php bin/grav --version

# Search for error_log usage inside blueprints and page frontmatter
grep -RIn --include='*.yaml' --include='*.md' 'error_log' user/ system/ 2>/dev/null

# List PHP files created under the web root in the last 30 days
find /var/www/grav -type f -name '*.php' -mtime -30 -printf '%T+ %p\n' | sort