Remote Code Execution in Grav Web Platform Prior to 2.0.7
CVE-2026-64850
8.7HIGH
What is CVE-2026-64850?
Grav is a file-based web platform where a vulnerability in the Blueprint::dynamicData() function allows an authenticated user with specific permissions to exploit the system. This occurs due to insufficient validation of user-supplied parameters in call_user_func_array(). A malicious user can leverage this flaw to execute arbitrary commands on the server by injecting code into the page frontmatter, effectively executing it as the web server user upon page rendering. The issue was addressed in version 2.0.7, which mitigates this risk by properly validating inputs, ensuring a significant enhancement in the security posture of the Grav platform.
Affected Version(s)
grav < 2.0.7