Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)

A missing validation check in `FlexDirectory::dynamicDataField()` allows the method to resolve blueprint `data-*@:` directives by calling `call_user_func_array()` on attacker-influenced input, verifying only that the target is callable without restricting dangerous functions such as `exec`, `system`, `passthru`, or `shell_exec`. Because `FlexDirectory` registers this handler for every Flex directory, the fix applied in 2.0.7 to `Blueprint::dynamicData()` (GHSA-fj2p-qj2f-74v5) is bypassed entirely. Any authenticated user holding create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server. Affected versions: - >= 1.7.0 We recommend updating to: 2.0.9. CVSS 8.7 · our assessment: this_week Reference: https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm Details: https://vuln.today/cve/CVE-2026-65608