CVE-2026-64850
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfunc_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
https://github.com/getgrav/grav/releases/tag/2.0.7, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64850.json, https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5, https://nvd.nist.gov/vuln/detail/CVE-2026-64850, https://github.com/getgrav/grav/commit/acffa34cbb0787fee87c609e0d6289e904fee33c