CVE-2026-65608 in Grav
Summary
by MITRE • 07/23/2026
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists in Grav CMS versions 1.7.0 through 2.0.8 and represents a critical remote code execution flaw that affects the Flex directory functionality. The issue stems from the FlexDirectory::dynamicDataField() method which processes blueprint data-*@: directives by utilizing call_user_func_array() with attacker-controlled input. This implementation performs only basic callable validation through is_callable() checks without implementing proper restrictions on dangerous functions such as exec, system, passthru, or shell_exec. The vulnerability affects all Flex-based directories including Flex Users, Flex Pages, Flex Objects, and custom Flex types, making it particularly dangerous as it bypasses the security measures introduced in version 2.0.7 for Blueprint::dynamicData().
The technical flaw manifests when authenticated users with create or update permissions attempt to manipulate Flex directory data through blueprint directives. The call_user_func_array() function allows arbitrary code execution because the validation logic fails to enumerate and block potentially harmful PHP functions that could execute shell commands on the underlying server. This represents a classic path traversal and command injection vulnerability where user input flows directly into the function execution mechanism without proper sanitization or whitelisting of allowed operations.
The operational impact of this vulnerability is severe as it enables attackers with minimal privileges to achieve full system compromise through authenticated access to any Flex-based directory. The attack surface includes all authenticated users who possess create or update permissions, which typically encompasses editors, content managers, and administrators depending on the specific Grav configuration. Once exploited, attackers can execute arbitrary shell commands, potentially leading to complete server takeover, data exfiltration, or deployment of persistent backdoors.
Security mitigations should focus on immediate patching to versions 2.0.9 or later where the vulnerability has been addressed through proper input validation and function restriction. Organizations should implement strict access controls limiting create and update permissions to only essential administrators, utilize network segmentation to restrict access to Grav installations, and deploy monitoring solutions to detect suspicious command execution patterns. The vulnerability aligns with CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and follows ATT&CK tactics including TA0002 (Execution) and TA0004 (Privilege Escalation) when exploited by attackers with valid credentials.