Grav CMS Blueprint::dynamicData() Unsanitized Callable Remote Code Execution
First seen Jul 22, 2026 · Updated Jul 22, 2026 · CVSS 9.8
Grav CMS 2.0.4 contains a critical RCE vulnerability in its Blueprint::dynamicData() function, which passes attacker-controlled callable strings directly to call_user_func_array() without an allowlist. An authenticated user with page-write permissions can plant a malicious callable in page frontmatter that executes as the web-server user whenever any visitor loads the page, effectively converting low-privilege access into full server compromise.
Technical Analysis
The vulnerability resides in system/src/Grav/Common/Data/Blueprint.php, where dynamicData() resolves 'Class::method' style directives from page frontmatter and invokes them via call_user_func_array() without validating the class, method, or arguments against a safe allowlist. Because the form plugin routes user-influenced frontmatter through this code path, an account holding admin.pages or api.pages.write can inject a malicious callable that executes arbitrary PHP under the web server's identity, and the payload fires for any subsequent visitor (including unauthenticated ones) who loads the affected page, making it an effective privilege-escalation-to-RCE and persistent web-shell primitive. The CVSS 9.8 rating reflects the low attack complexity, ease of persistence via stored page content, and impact on confidentiality, integrity, and availability of the host. Any organization self-hosting Grav to power internal wikis, documentation portals, or knowledge bases used as RAG data sources for AI agents should treat compromised pages as a vector for injecting malicious instructions or exfiltrating API keys/credentials stored on the host, directly impacting agent pipelines that ingest or execute content retrieved from these systems.
Affected Systems
Grav CMS version 2.0.4 (fixed in 2.0.7); specifically system/src/Grav/Common/Data/Blueprint.php and the form plugin's frontmatter processing path; any deployment allowing accounts with admin.pages or api.pages.write permissions
Indicators of Compromise
- No specific hashes, IPs, or domains published; indicators are behavioral — look for anomalous Class::method callable strings in page frontmatter/blueprint YAML, unexpected PHP process spawning from www-data/apache/nginx user, unauthorized modifications to page.md or blueprint files, and outbound connections initiated from the Grav web root
Remediation Steps
- 1
Upgrade Grav CMS
Update immediately to Grav 2.0.7 or later, which remediates the unsanitized call_user_func_array() usage in Blueprint::dynamicData().
- 2
Restrict page-write permissions
Audit and minimize accounts holding admin.pages or api.pages.write; enforce least privilege and require approval workflows for frontmatter/blueprint changes.
- 3
Audit page content and blueprints
Scan existing pages and frontmatter for suspicious Class::method callable strings or unexpected dynamic data directives introduced before patching.
- 4
Harden web server execution context
Run the web server process with minimal privileges, disable unnecessary PHP functions (e.g., exec, shell_exec) where feasible, and deploy WAF rules to detect callable injection patterns.
- 5
Rotate exposed credentials
If Grav is used as a data source or backend for AI agent/RAG pipelines, rotate any API keys, tokens, or secrets accessible from the compromised host and audit agent access logs for anomalous activity.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.