CVE-2026-65608
Received Received - Intake

Remote Code Execution in Grav CMS

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65608
EUVD
EUVD-2026-48244

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav From 1.7.0 (inc) to 2.0.8 (inc)
getgrav grav 2.0.9
getgrav grav From 1.7.0 (inc) to 2.0.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a remote code execution vulnerability in Grav CMS versions 1.7.0 to 2.0.8. The issue is in the FlexDirectory::dynamicDataField() method which processes blueprint data-*@: directives. It calls call_user_func_array() on attacker-controlled input without properly restricting dangerous functions like exec or system. Any authenticated user with create or update permissions on Flex-based directories can exploit this to run arbitrary shell commands on the server.

Detection Guidance

Check Grav version with: grep -r "version" /var/www/html/user/config/system.yaml. If version is >=1.7.0 and <2.0.9, it is vulnerable. Look for unauthorized shell commands in logs like /var/log/apache2/access.log or /var/log/nginx/access.log.

Impact Analysis

An attacker with minimal permissions could execute arbitrary commands on your server, potentially leading to full system compromise. This includes accessing sensitive data, installing malware, or disrupting services. The impact depends on server configuration and user permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. A successful exploit may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for organizations handling protected information.

Mitigation Strategies

Upgrade Grav to version 2.0.9 or later immediately. If upgrading is not possible, apply the patch from GHSA-c4wf-2xxc-68qm to add isSafeDynamicCall() validation in FlexDirectory::dynamicDataField(). Restrict user permissions to prevent unauthorized access to Flex directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart