CVE-2026-69088 in Grav
Summary
by MITRE • 08/03/2026
Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists within Grav CMS versions 2.0.7 through 2.0.10 where the blueprint system fails to properly validate static method calls in dynamic-field directives. The core issue stems from the Blueprint::isSafeDynamicCall() function which implements a dangerous-callable denylist but only applies this restriction to strings that do not contain the '::' delimiter used for static method invocation in PHP. This creates a critical security gap where attackers can bypass validation by using fully-qualified static method calls instead of simple string representations.
The vulnerability allows privilege escalation through a specific attack vector involving page editing permissions. An attacker with only admin.pages rights (not super-admin or admin.pages_twig) can inject malicious directives into page frontmatter that execute arbitrary public static PHP methods with attacker-controlled arguments. This represents a significant bypass of the CMS's permission model since the attacker does not require full administrative privileges to exploit this vulnerability, demonstrating a classic case of insufficient authorization checks.
The operational impact of this vulnerability is severe and multifaceted. Attackers can leverage built-in gadget methods to read any file that the web server can access, with the contents disclosed to anonymous visitors of the crafted page, effectively creating an information disclosure vulnerability. Additionally, the exploit enables arbitrary creation, copying, and manipulation of files and directories under the web-server account, potentially allowing for persistent access, data exfiltration, or further compromise of the system. This aligns with CWE-707 and represents a code injection vulnerability that can be exploited through user-controllable input in configuration directives.
The attack surface is particularly concerning because it operates within the CMS's legitimate form-field processing mechanisms, making it difficult to detect through standard security monitoring. The vulnerability demonstrates how insufficient input validation at the blueprint level can create a pathway for remote code execution and privilege escalation. Mitigation strategies include upgrading to Grav CMS version 2.0.11 where the fix is implemented, implementing additional input sanitization checks, and restricting page editing permissions more strictly. Organizations should also consider implementing web application firewalls and monitoring for unusual patterns in frontmatter data processing. This vulnerability maps to ATT&CK technique T1548.003 (Abuse Elevation Control Mechanism) and T1078.004 (Valid Accounts: Cloud Accounts) when considering the privilege escalation aspects of the exploit.