CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
Authenticated users can inject malicious code via page frontmatter, leading to remote code execution on the server when the page is accessed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65008?
CVE-2026-65008 is a critical code injection vulnerability in getgrav grav, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.
Weakness: CWE-94
Which versions are affected by CVE-2026-65008?
How do I fix CVE-2026-65008?
No fix has been published for CVE-2026-65008 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-65008 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65008 exists.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-3q93-h5p2-5mx8.