CVE-2026-69088 Details
Description
Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.
A vulnerability in Grav CMS versions 2.0.7 prior to 2.0.10 allows arbitrary static method invocation through blueprint dynamic-field directives. This issue arises because the method responsible for validating callable strings only applies its denylist to unqualified method names. As a result, an account with page-editing rights can inject directives that invoke public static PHP methods with controlled arguments. Exploiting this flaw with certain built-in methods could lead to unauthorized reading of server files, which would be disclosed to anonymous visitors of the affected page, and unauthorized creation or modification of files and directories under the web server account.
Users are advised to update Grav CMS to version 2.0.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-cms-through-arbitrary-method-invocation-via-blueprint | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav CMS | >= 2.0.7, <= 2.0.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |