EUVD-2026-48244
GHSA-c4wf-2xxc-68qm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as user with Flex create/update rights
-
DeliveryEdit Flex object with malicious data-*@: directive
-
ExploitdynamicDataField() passes is_callable() check
-
Executioncall_user_func_array() invokes system/exec
-
PersistArbitrary shell command runs as web user
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V15 - Secure Coding and Architecture Reflection safety, class allowlisting
|
| Exploitation Conditions | Requires an authenticated Grav account that holds create or update permission on at least one Flex-based directory (Flex Users, Flex Pages, Flex Objects, or a custom Flex type) - the attacker must be able to submit or edit blueprint data containing a data-*@: dynamic directive. Because FlexDirectory registers the vulnerable handler for every Flex directory, no special or non-default feature toggle is needed beyond having Flex directories in use (the default in Grav 1.7+/2.x admin). Limiting factors: exploitation is authenticated (PR:L) and gated on that create/update permission, so anonymous/read-only users cannot trigger it; there is no user-interaction requirement and the vector is fully network-reachable (AV:N/AC:L/UI:N). The 2.0.7 mitigation in Blueprint::dynamicData() does NOT limit this path, so patched-to-2.0.7 sites remain exposed until 2.0.9. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) reflects a network-reachable, low-complexity attack that requires low privileges (an authenticated account with Flex create/update rights) and no user interaction, yielding full confidentiality, integrity, and availability impact - i.e. arbitrary command execution. This is a genuine high-priority issue: the only real barrier is obtaining an account with create/update permission on a Flex directory, and in many Grav deployments editor/author roles satisfy that. No EPSS score was provided, so statistical exploitation probability cannot be quantified. It is not listed in CISA KEV and no POC was provided, so this is not confirmed active exploitation - but the low complexity, deterministic trigger, and clear root cause make weaponization straightforward once details are public. One caveat to verify: the referenced patch commit diff shows a v2.0.9 version bump plus unrelated Markdown/angle-bracket changes, not the actual dynamicDataField() hardening, so the exact remediating code should be confirmed against the GHSA-c4wf-2xxc-68qm advisory rather than this commit alone. |
| Exploit ScenarioDerived | An attacker who registers or compromises a low-privileged Grav account with create/update rights on any Flex directory edits an object and supplies a blueprint data-*@: directive that names a shell-execution function (e.g. system) with an attacker-controlled command. When FlexDirectory::dynamicDataField() resolves the field, is_callable() passes and call_user_func_array() runs the command as the web server user, giving full server-side code execution over the network with no victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Remote code execution in Grav CMS (>= 1.7.0, < 2.0.9) allows any authenticated user holding create or update permission on any Flex-based directory to run arbitrary shell commands on the server. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives through call_user_func_array() while checking only is_callable(), so dangerous functions like exec, system, passthru, and shell_exec are never blocked. This re-opens the same class of flaw that GHSA-fj2p-qj2f-74v5 patched in Blueprint::dynamicData() (2.0.7), because the FlexDirectory handler bypasses that fix. No public exploit identified at time of analysis, though the issue was reported by VulnCheck with a dedicated advisory.
RemediationAI
Vendor-released patch: 2.0.9 - upgrade all Grav installations to 2.0.9 or later (release commit https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969), and review GHSA-c4wf-2xxc-68qm for the authoritative fix details. Until patching is possible, reduce the privilege surface by auditing and revoking create/update permissions on Flex directories from any account that does not strictly need them, since exploitation depends on that permission; expect this to disable legitimate content editing for those roles. As additional compensating controls, restrict admin panel and Flex-editing endpoints to trusted IPs or VPN, place the site behind a WAF that inspects blueprint/form submissions for data-*@: directives referencing exec/system/passthru/shell_exec, and enforce PHP disable_functions to block those OS-execution wrappers at the interpreter level - noting that disable_functions may break plugins or themes that legitimately shell out. Do not rely on these mitigations as a substitute for upgrading, as the core call_user_func_array() flaw remains.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a PHP-based flat-file CMS whose admin/data layer uses 'Flex Objects' - a framework for defining and editing structured content (Flex Users, Flex Pages, Flex Objects, and custom Flex types) via YAML blueprints. Blueprints support dynamic 'data-*@:' directives that map a field to a PHP callable at render/resolve time. The vulnerable path is FlexDirectory::dynamicDataField(), which passes attacker-influenced directive input into call_user_func_array() and gates it only with is_callable(). is_callable() returns true for any built-in PHP function, including OS command execution wrappers, so the guard does not distinguish safe accessors from dangerous system calls. This maps to CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / unsafe reflection): the choice of function to invoke is derived from untrusted blueprint data. Notably, FlexDirectory registers this handler for every Flex directory, so the previously added validation in Blueprint::dynamicData() (2.0.7) is bypassed entirely.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable authenticated user with Flex create/update rights (PR:L) reliably triggers OS command execution with no interaction, giving full C/I/A impact within the server scope.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.
Executive ViewAI
Grav CMS versions 1.7.0 through 2.0.8 contain a remote code execution vulnerability allowing authenticated users with directory management permissions to execute arbitrary server commands. This represents a significant risk to organizations using Grav, as compromised administrator accounts or malicious insiders with directory permissions could gain complete server control. Immediate restrictions on who has directory access and comprehensive monitoring are required.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: restrict create and update permissions on all Flex-based directories to only trusted system administrators; require multi-factor authentication for these administrative accounts; disable Flex-based directory functionality if not actively required for business operations; implement comprehensive monitoring of server process execution logs, watching specifically for anomalous execution of shell commands (exec, system, passthru, shell_exec); maintain detailed audit trails of all administrative actions for forensic review if exploitation is suspected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB