← Vulnerability feed

Vulnerability record · CVE-2026-65608 · published 23 July 2026

CVE-2026-65608: Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability.

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.

8.7 CVSS 4.0 High EPSS 1.3% · top 31.2% CWE-470 · CWE-470 Deferred
8.7CVSS 4.0 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
4References
23 Jul 2026Last modified by NVD

Description

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969
https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm
https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-flexdirectory
https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm

Track CVE-2026-65608 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-82078PaperCut MF/NG unsafe dynamic class loading enables code executionPaperCut MF and NG instantiate database driver classes from configurable driver names without validating them against an allowlist of approved driver…KEVEPSS 3.8%analysed9.8CVE-2021-21985VMware vCenter Server Virtual SAN Health Check plug-in RCEThe vSphere Client (HTML5) in vCenter Server fails to validate input in the Virtual SAN Health Check plug-in, which is enabled by default. This allow…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2026-65608), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.