Executive brief
Grav CMS is a flat-file content management system used to build and manage websites. A validation bypass in its blueprint dynamic-field system allows users with page-editing privileges to invoke arbitrary PHP methods and read sensitive files or create/modify files on the server, potentially exposing customer data or compromising website integrity.
Technical details
The vulnerability is a code injection flaw in the Blueprint::isSafeDynamicCall() method (system/src/Grav/Common/Data/Blueprint.php) that fails to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives. The dangerous-callable denylist is only applied to strings without '::' characters, allowing fully-qualified class method invocations to bypass security checks entirely. An attacker with page-editing rights (admin.pages permission, not super-admin) can plant a directive in page form-field frontmatter that calls arbitrary public static PHP methods with attacker-controlled arguments. Using built-in PHP gadget methods, this permits arbitrary file disclosure to anonymous visitors and creation/copying of files and directories under the web-server account. The vulnerability affects versions 2.0.7 through 2.0.10 and was fixed in 2.0.11.
Affected products
- Grav Grav CMS 2.0.7 through 2.0.10
Timeline
- 2026-07-21: disclosed
- 2026-09-17: patched: Version 2.0.11 contains the fix
- 2026-08-03: advisory