High severity · published Aug 19, 2026
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
< 2.0.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64850
github.com
https://github.com/getgrav/grav/commit/acffa34cbb0787fee87c609e0d6289e904fee33c
github.com
https://github.com/getgrav/grav/releases/tag/2.0.7
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)