CVE-2026-65008
Grav CMS version 2.0.4 contains a remote code execution flaw in Blueprint::dynamicData() that lets an authenticated user with admin.pages or api.pages.write permission inject a malicious callable into a page's frontmatter. When any visitor (even unauthenticated) views the page, the injected code runs as the web‑server user. The issue is fixed in Grav 2.0.7.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Grav 2.0.4
Real-world impact
An attacker with limited admin privileges can achieve full remote code execution on the server, potentially compromising the entire site.
Why this severity
CVSS v4.0 base score 9.3 (Critical) reflects network‑adjacent, low‑complexity attack requiring no user interaction and high impact on confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade Grav to version 2.0.7 or later.
- 022. After upgrading, verify the version number in the admin dashboard or via command line.
- 033. Restart the web server if required: No additional steps are specified by the vendor; a service restart is not mandatory but may be advisable to ensure the new code is loaded.
NVD-referenced vendor advisory (fixed in 2.0.7)
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.