Arbitrary File Write Vulnerability in Grav by Get Grav

CVE-2026-75827

What is CVE-2026-75827?

Grav, a popular flat-file CMS, has an arbitrary file write vulnerability prior to version 2.0.15. This flaw arises from insufficient validation in the Blueprint dynamic-data bare-function, which employs an incomplete denylist instead of a secure positive allowlist. Attackers possessing page-edit or blueprint-config access can exploit this vulnerability by invoking the error_log function through a data directive, enabling them to append malicious PHP payloads to files accessible over the web. This could potentially lead to remote code execution, posing a significant risk to the integrity and security of affected systems.

References