CVE-2026-75827: Grav Blueprint bare-function arbitrary file write via error_log

CVE-2026-75827 · Severity: high · CVSS 8.8 · Published 2026-08-18

Grav is a flat-file content management system used to build websites and manage pages. A vulnerability in the Blueprint dynamic-data handler allows authenticated users (those with page-edit or blueprint-config access) to write arbitrary PHP code to files on the server, leading to remote code execution. An attacker can exploit this by crafting a malicious blueprint field that invokes the error_log function with attacker-controlled content and file paths, bypassing the intended security restrictions.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-75827 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75827 being exploited in the wild.
How severe is CVE-2026-75827?
High severity, with a CVSS score of 8.8, published 18 August 2026.
Which products and versions are affected?
Grav 2.0.13 and likely other 2.x versions; getgrav/grav (Packagist) <= 2.0.14, ECOSYSTEM:introduced=0,fixed=2.0.15.
Is there a fix for CVE-2026-75827?
Yes. getgrav/grav (Packagist): upgrade to 2.0.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75827 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-75827?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.15 or later
    composer require getgrav/grav:^2.0.15

Technical details

The vulnerability is a denylist-bypass in the bare-function branch of Blueprint::isSafeDynamicCall() (Blueprint.php:530–534), which validates dynamic-data providers before execution via call_user_func_array(). While the Class::method branch uses a strict positive allowlist, the bare-function branch relies only on isDangerousFunction(), which is incomplete. The error_log() function is not in the denylist, allowing an attacker to invoke error_log($payload, 3, $filepath) to append arbitrary PHP code to a web-accessible file. An authenticated user (page-edit or blueprint-config role) can inject a malicious data directive in a blueprint to reach the sink; the paramsContainDangerousCallable() check does not block PHP payload strings, only callable references. The attacker achieves arbitrary file write and code execution without shell access.

Affected products

  • Grav Grav 2.0.13 and likely other 2.x versions

Identifiers

  • CVE-2026-75827
  • GHSA-f8wv-xp27-6gq7

Timeline

  • 2026-09-17: disclosed
  • 2026-09-17: advisory: GHSA-f8wv-xp27-6gq7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.