Executive brief
Grav CMS is a flat-file content management system used to build and manage websites. A security flaw allows users with basic page-editing permissions to inject malicious code directives into page content that can read sensitive files (including administrator password hashes) or create/modify files on the server. Unauthenticated visitors viewing an affected page would see the stolen information, potentially exposing site credentials and enabling account takeover or server compromise.
Technical details
The vulnerability is an incomplete callable validation bypass in `Blueprint::isSafeDynamicCall()` that fails to screen fully-qualified static method calls (Class::method format). The guarding function only blocks dangerous function names that do not contain `::`; any string with `::` bypasses validation and is passed directly to `call_user_func_array()`. An attacker with `admin.pages` permission (page-editor role, not super-admin) can plant a malicious dynamic-field directive in page frontmatter (e.g., `data-opts@: ['Grav\Common\Utils::download', '/etc/passwd', ...]`) that invokes arbitrary public static methods with attacker-controlled arguments. No network authentication is required to trigger the payload—unauthenticated visitors simply request the page. Demonstrated gadgets include `Utils::download` for arbitrary file read and `Folder::copy`/`move`/`delete` for file system manipulation. This bypasses Grav's intended permission model, which separates code execution (`admin.pages_twig`) from plain editing (`admin.pages`). Patches are available in current Grav versions.
Affected products
- Grav Grav 2.0.7 through 2.0.10, and develop branch at commit db8c1fc (self-reporting as 2.0.11)
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory: GHSA-7pgq-cr25-xvc8 published