# CVE-2026-75827: Grav Blueprint bare-function arbitrary file write via error_log

Source: https://junglewise.ai/threats/cve-2026-75827-grav-blueprint-bare-function-arbitrary-file-write-via-error-log  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75827 · Severity: high · CVSS 8.8 · Published 2026-08-18

Grav is a flat-file content management system used to build websites and manage pages. A vulnerability in the Blueprint dynamic-data handler allows authenticated users (those with page-edit or blueprint-config access) to write arbitrary PHP code to files on the server, leading to remote code execution. An attacker can exploit this by crafting a malicious blueprint field that invokes the error_log function with attacker-controlled content and file paths, bypassing the intended security restrictions.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-75827 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75827 being exploited in the wild.

**How severe is CVE-2026-75827?** High severity, with a CVSS score of 8.8, published 18 August 2026.

**Which products and versions are affected?** Grav 2.0.13 and likely other 2.x versions; getgrav/grav (Packagist) <= 2.0.14, ECOSYSTEM:introduced=0,fixed=2.0.15.

**Is there a fix for CVE-2026-75827?** Yes. getgrav/grav (Packagist): upgrade to 2.0.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75827 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75827?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.15 or later

  ```sh
  composer require getgrav/grav:^2.0.15
  ```


## Technical details

The vulnerability is a denylist-bypass in the bare-function branch of Blueprint::isSafeDynamicCall() (Blueprint.php:530–534), which validates dynamic-data providers before execution via call_user_func_array(). While the Class::method branch uses a strict positive allowlist, the bare-function branch relies only on isDangerousFunction(), which is incomplete. The error_log() function is not in the denylist, allowing an attacker to invoke error_log($payload, 3, $filepath) to append arbitrary PHP code to a web-accessible file. An authenticated user (page-edit or blueprint-config role) can inject a malicious data directive in a blueprint to reach the sink; the paramsContainDangerousCallable() check does not block PHP payload strings, only callable references. The attacker achieves arbitrary file write and code execution without shell access.

## Affected products

- Grav Grav 2.0.13 and likely other 2.x versions

## Identifiers

- CVE-2026-75827
- GHSA-f8wv-xp27-6gq7

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: advisory: GHSA-f8wv-xp27-6gq7

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)