Executive brief
Grav is a flat-file CMS used to build websites without a database. Administrators with page-editing permissions can craft malicious pages that execute arbitrary shell commands on the server when any visitor — including unauthenticated users — views the page. The attacker abuses a code path that accepts any PHP callable without validation, allowing command execution as the web server user.
Technical details
The vulnerability is a code injection flaw (CWE-94) in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php:426), which passes untrusted Class::method strings directly to call_user_func_array() with no allowlist or validation. The Form plugin processes page frontmatter through this code path, giving a page author full control over the callable. An attacker with admin.pages or api.pages.write permission can inject a malicious YAML-based callable directive that chains Grav\Common\Utils::arrayFilterRecursive() with the system() function, executing shell commands. Because this code runs during page rendering (not just during save), any unauthenticated visitor triggering a page view will execute the attacker's payload. The vulnerability is fixed in version 2.0.7.
Affected products
- Grav Grav CMS < 2.0.7
Timeline
- 2026-07-07: disclosed
- 2026-09-02: patched