Quick answers
- Is CVE-2026-64850 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-64850 being exploited in the wild.
- How severe is CVE-2026-64850?
- High severity, with a CVSS score of 4, published 19 August 2026.
- Which products and versions are affected?
- Grav < 2.0.7; getgrav/grav (Packagist) < 2.0.7, ECOSYSTEM:introduced=0,fixed=2.0.7.
- Is there a fix for CVE-2026-64850?
- Yes. getgrav/grav (Packagist): upgrade to 2.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-64850 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-64850?
- Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- getgrav/grav (Packagist): upgrade to 2.0.7 or later
composer require getgrav/grav:^2.0.7
Technical details
The vulnerability is a code injection flaw (CWE-94) in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php:426), which passes untrusted Class::method strings directly to call_user_func_array() with no allowlist or validation. The Form plugin processes page frontmatter through this code path, giving a page author full control over the callable. An attacker with admin.pages or api.pages.write permission can inject a malicious YAML-based callable directive that chains Grav\Common\Utils::arrayFilterRecursive() with the system() function, executing shell commands. Because this code runs during page rendering (not just during save), any unauthenticated visitor triggering a page view will execute the attacker's payload. The vulnerability is fixed in version 2.0.7.
Affected products
- Grav Grav CMS < 2.0.7
Identifiers
- CVE-2026-64850
- GHSA-fj2p-qj2f-74v5
Timeline
- 2026-07-07: disclosed
- 2026-09-02: patched