CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory
Authenticated users with Flex directory permissions can execute arbitrary shell commands via unsafe dynamic data field resolution in Grav CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65608?
CVE-2026-65608 is a high-severity code injection vulnerability in getgrav grav, published on 23 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.
Weakness: CWE-470
Which versions are affected by CVE-2026-65608?
2 open source packages ship an affected version, including getgrav/grav.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | From 1.7.0 | 2.0.9 |
getgrav/grav Packagist | From 1.7.0 | 2.0.9 |
How do I fix CVE-2026-65608?
Upgrade getgrav/grav to 2.0.9 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-65608 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65608 exists.
Sources
Also known as GHSA-c4wf-2xxc-68qm.