DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72819: CVE-2026-72819: Remote Code Execution in Grav CMS via Dynamic Callable Validation Bypass in Blueprint

#security #cve #cybersecurity

CVE-2026-72819: Remote Code Execution in Grav CMS via Dynamic Callable Validation Bypass in Blueprint

Vulnerability ID: CVE-2026-72819
CVSS Score: 8.8
Published: 2026-09-17

CVE-2026-72819 is a high-severity Remote Code Execution (RCE) vulnerability in Grav CMS before version 2.0.13. The vulnerability lies in the validation of dynamic data providers (callbacks) within the Flex Objects plugin settings and blueprints, allowing administrative users to bypass validation checks via array-notation callables. This validation failure enables administrative users to execute arbitrary PHP classes and methods, including the GPM Installer unZip routine, leading to full remote code execution on the server.

TL;DR

Authenticated Remote Code Execution in Grav CMS before 2.0.13 via array-notation dynamic data providers.

⚠️ Exploit Status: POC

Technical Details

  • Vulnerability ID: CVE-2026-72819
  • CWE ID: CWE-94
  • CVSS v3.1 Score: 8.8 (High)
  • Exploit Status: Proof of Concept (PoC) verified
  • Affected Component: Blueprint Dynamic Callables
  • Remediation: Upgrade to version 2.0.13

Affected Systems

  • Grav CMS
  • Grav CMS: < 2.0.13 (Fixed in: 2.0.13)

Code Analysis

Commit: 81740e2

Fix dynamic call bypass vulnerability in Blueprint.php

Exploit Details

Mitigation Strategies

  • Upgrade Grav CMS to version 2.0.13 or later.
  • Restrict administrative interface access to trusted networks or IP ranges.
  • Implement Web Application Firewall (WAF) rules targeting raw YAML configuration modifications in request streams.
  • Harden filesystem permissions, ensuring that the web daemon has write restrictions on the root application directory.

Remediation Steps:

  1. Back up existing Grav CMS installations, configurations, and core user directories.
  2. Upgrade the Grav CMS system using administrative CLI tools or official packaging systems to version 2.0.13.
  3. Verify the validation logic update inside system/src/Grav/Common/Data/Blueprint.php.
  4. Inspect user-defined blueprints and Flex Objects configurations for array configurations using callables.
  5. Monitor web server error logs and execution paths for indicators of unauthorized file extractions.

References

Read the full report for CVE-2026-72819 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)