EUVD-2026-48244
GHSA-pp9r-ppc4-25w4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authenticated user with Flex create/update rights (PR:L) reliably triggers OS command execution with no interaction, giving full C/I/A impact within the server scope.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.
AnalysisAI
Remote code execution in Grav CMS (>= 1.7.0, < 2.0.9) allows any authenticated user holding create or update permission on any Flex-based directory to run arbitrary shell commands on the server. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives through call_user_func_array() while checking only is_callable(), so dangerous functions like exec, system, passthru, and shell_exec are never blocked. This re-opens the same class of flaw that GHSA-fj2p-qj2f-74v5 patched in Blueprint::dynamicData() (2.0.7), because the FlexDirectory handler bypasses that fix. No public exploit identified at time of analysis, though the issue was reported by VulnCheck with a dedicated advisory.
Technical ContextAI
Grav is a PHP-based flat-file CMS whose admin/data layer uses 'Flex Objects' - a framework for defining and editing structured content (Flex Users, Flex Pages, Flex Objects, and custom Flex types) via YAML blueprints. Blueprints support dynamic 'data-*@:' directives that map a field to a PHP callable at render/resolve time. The vulnerable path is FlexDirectory::dynamicDataField(), which passes attacker-influenced directive input into call_user_func_array() and gates it only with is_callable(). is_callable() returns true for any built-in PHP function, including OS command execution wrappers, so the guard does not distinguish safe accessors from dangerous system calls. This maps to CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / unsafe reflection): the choice of function to invoke is derived from untrusted blueprint data. Notably, FlexDirectory registers this handler for every Flex directory, so the previously added validation in Blueprint::dynamicData() (2.0.7) is bypassed entirely.
RemediationAI
Vendor-released patch: 2.0.9 - upgrade all Grav installations to 2.0.9 or later (release commit https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969), and review GHSA-c4wf-2xxc-68qm for the authoritative fix details. Until patching is possible, reduce the privilege surface by auditing and revoking create/update permissions on Flex directories from any account that does not strictly need them, since exploitation depends on that permission; expect this to disable legitimate content editing for those roles. As additional compensating controls, restrict admin panel and Flex-editing endpoints to trusted IPs or VPN, place the site behind a WAF that inspects blueprint/form submissions for data-*@: directives referencing exec/system/passthru/shell_exec, and enforce PHP disable_functions to block those OS-execution wrappers at the interpreter level - noting that disable_functions may break plugins or themes that legitimately shell out. Do not rely on these mitigations as a substitute for upgrading, as the core call_user_func_array() flaw remains.
Share
External POC / Exploit Code
Leaving vuln.today