Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
Grav CMS lets page editor read files and create files
published 3 months ago
Summary
Versions 2.0.7 through 2.0.10 of Grav CMS do not fully check special code that can be added to a page's form settings. A user who can edit pages can insert a command that runs any public static function, allowing them to view any file the server can read and to create or copy files on the server. Updating Grav to version 2.0.11 or newer resolves the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | getgrav | grav | >= 2.0.7, <= 2.0.10 |
Original advisory text
Duplicate Advisory: Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-7pgq-cr25-xvc8. This link is maintained to preserve external references.
### Original Description
Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.
This advisory has been withdrawn because it is a duplicate of GHSA-7pgq-cr25-xvc8. This link is maintained to preserve external references.
### Original Description
Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-94Code Injection
Timeline
Published3 Aug 2026
Updated17 Sep 2026
First seen17 Sep 2026
Sources
GHSA-vj8j-973f-r65j · GHSA
Track software like this
Free during beta