CVE-2026-64850
Received Received - Intake

Grav Blueprint Dynamic Data Command Execution

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-64850
EUVD
EUVD-2026-62549

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav to 2.0.7 (exc)
getgrav grav to 2.0.4 (inc)
grav grav to 2.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64850 is a vulnerability in Grav CMS where a page editor with admin.pages or api.pages.write permissions can execute arbitrary commands on the server. The issue occurs in the Blueprint::dynamicData() function which allows an editor-controlled callback to be passed to call_user_func_array() without proper validation. This enables an attacker to use Grav\Common\Utils::arrayFilterRecursive() as a trampoline to run system commands placed in a page's frontmatter when the page is viewed.

Detection Guidance

Check Grav CMS version with: grep -r "version" /path/to/grav/vendor/grav/core/CHANGELOG.md. If version is below 2.0.7, the system is vulnerable. Inspect page frontmatter for suspicious commands like shell_exec or system calls in YAML files.

Impact Analysis

This vulnerability allows an attacker with limited page editing access to execute arbitrary commands on your server as the web server user. This could lead to full system compromise, data theft, or unauthorized modifications. Even unauthenticated users could trigger the exploit when viewing the crafted page, making it particularly dangerous.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, regulatory fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade Grav CMS to version 2.0.7 or later immediately. Remove admin.pages and api.pages.write permissions from untrusted users. Review page frontmatter for unauthorized commands and audit recent page edits for suspicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart