CVE-2026-65008: Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method cal

criticalpublic exploitCVSS 9.8CVE-2026-65008

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.8
Published: 2026-07-21
Last updated: 2026-07-22
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-65008

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-650080.84% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-65008	coverage & exploitation status	NVD · CVE.org

Recent advisories for Grav

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-66400: Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerabil…nvd · 2026-07-29
highCVE-2026-65897: Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsControl…nvd · 2026-07-23
highCVE-2026-65896: Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly val…nvd · 2026-07-23
highCVE-2026-65895: Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plug…nvd · 2026-07-23
highCVE-2026-65608: Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDir…nvd · 2026-07-23
highCVE-2026-65603: The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation fl…nvd · 2026-07-22

CVE-2026-65008: Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method cal

Details

Exploitation outlook

Referenced CVEs

Recent advisories for Grav

More from NVD Recent CVEs