Getgrav Grav up to 2.0.14 Blueprint error_log incomplete blacklist

Summaryinfo

A vulnerability identified as critical has been detected in Getgrav Grav up to 2.0.14. Affected is the function error_log of the component Blueprint. Performing a manipulation results in incomplete blacklist. This vulnerability was named CVE-2026-75827. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Getgrav Grav up to 2.0.14. It has been classified as critical. This affects the function error_log of the component Blueprint. The manipulation with an unknown input leads to a incomplete blacklist vulnerability. CWE is classifying the issue as CWE-184. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-75827 since 08/18/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1562.006 for this issue.

Upgrading to version 2.0.15 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Getgrav

Name

• Grav

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14

Website

• Product: https://github.com/getgrav/grav/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion