Executive brief
Grav, a popular open-source content management system, contains a vulnerability that allows certain users to execute commands on the underlying server. An attacker with basic permissions to create or update content (such as users, pages, or objects) can exploit this flaw to take full control of the web server. This could lead to the theft of sensitive data, website defacement, or a complete service outage.
Technical details
A remote code execution (RCE) vulnerability exists in Grav's Flex framework due to an unsafe reflection flaw in FlexDirectory::dynamicDataField(). The component resolves 'data-*@:' directives in blueprints by passing attacker-influenced input to call_user_func_array(). While the system checks if the input is_callable(), it fails to restrict dangerous PHP functions such as exec(), system(), or shell_exec(). This vulnerability represents a bypass of a previous fix (GHSA-fj2p-qj2f-74v5) because the Flex system uses a separate, unprotected handler instead of the patched Blueprint::dynamicData() method. An authenticated attacker with 'create' or 'update' permissions on any Flex-based directory can trigger the vulnerability to achieve arbitrary command execution. The issue is addressed in version 2.0.9.
Affected products
- getgrav Grav >= 1.7.0, < 2.0.9
Timeline
- 2026-07-09: advisory: GitHub Security Advisory GHSA-c4wf-2xxc-68qm published
- 2026-07-23: disclosed: NVD publication of CVE-2026-65608
- 2026-07-23: patched: Fix released in version 2.0.9