CVE-2026-75827: Grav Arbitrary File Write & Remote Code Execution
Vulnerability ID: CVE-2026-75827
CVSS Score: 8.8
Published: 2026-09-17
An arbitrary file write and remote code execution vulnerability exists in Grav CMS before version 2.0.15. The vulnerability is caused by using an incomplete denylist validation approach for bare PHP functions in the Blueprint dynamic-data compiler, allowing authenticated users with page-editing or blueprint-configuration privileges to execute arbitrary functions such as error_log.
TL;DR
Incomplete denylist validation of bare PHP functions in Grav Blueprints allows authenticated users to trigger arbitrary file writes and achieve remote code execution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-94
- Attack Vector: Network
- CVSS v3.1: 8.8 (High)
- EPSS Score: 0.00777
- Exploit Status: PoC Verified
- KEV Status: Not Listed
Affected Systems
- Grav CMS Core
-
Grav CMS Core: < 2.0.15 (Fixed in:
2.0.15)
Code Analysis
Commit: d5f89d9
Fix dynamic bare function validation in isSafeDynamicCall by changing from a denylist to an allowlist model.
Exploit Details
- GitHub Security Advisory: Detailed technical advisory on the Grav core vulnerability.
Mitigation Strategies
- Upgrade Grav CMS Core to version 2.0.15 or later.
- Audit page frontmatter files for unauthorized dynamic data directives.
- Deploy Web Application Firewall (WAF) filtering on blueprint configurations.
Remediation Steps:
- Identify and document all active Grav CMS installations and their current versions.
- Download and deploy Grav Core 2.0.15 or subsequent security releases.
- Run audit scripts to scan for unauthorized dynamic directives in existing pages.
- Enable provenance-based trust mechanisms by locking down writable page directory configurations.
References
Read the full report for CVE-2026-75827 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)