Remote Code Execution Vulnerability in Grav by Get Grav

CVE-2026-65608

What is CVE-2026-65608?

Grav versions from 1.7.0 up to 2.0.9 are susceptible to a remote code execution flaw due to improper input validation in the FlexDirectory::dynamicDataField() function. This security gap allows authenticated users with create/update permissions on any Flex-based directory (including Flex Users, Flex Pages, Flex Objects, or custom types) to execute arbitrary shell commands on the server. The vulnerability arises because the function only checks if the target is callable without restricting the execution of dangerous commands such as exec, system, passthru, or shell_exec. Thus, effective remediation is critical to secure affected Grav installations.

References