Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)

Grav's Blueprint::dynamicData() passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. An authenticated account with the admin.pages or api.pages.write permission can plant a malicious callable directive in a page's frontmatter, causing arbitrary shell commands to execute as the web-server user whenever any visitor - including unauthenticated ones - accesses that page. Affected versions: - 2.0.4 We recommend updating to: 2.0.7. CVSS 9.3 · our assessment: act_now Reference: https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5 Details: https://vuln.today/cve/CVE-2026-65008