Grav CMS CVE-2026-69088

Exploitation requires an authenticated account in Grav CMS with the admin.pages permission (page-editing rights). Super-admin or admin.pages_twig privileges are explicitly NOT required - the vulnerability is reachable by the minimal content-editor role. The attacker must be able to save or modify the YAML frontmatter of a Grav page, which is the standard capability of the admin.pages role. The victim Grav instance must be running versions 2.0.7 through 2.0.10. Exploitation is limited by: (1) requirement for at least a page-editor account - unauthenticated exploitation is not possible per the CVSS PR:L vector; (2) file-read impact is bounded by what the web-server OS account can read; (3) file-write impact is bounded by what the web-server OS account can write. The admin.pages_twig permission (Twig templating for pages) is a separate, more powerful right and is explicitly noted as not required - meaning this affects a broader set of delegated-editor accounts than Twig-based injection paths.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 (High) and accurately reflects the threat model: network-accessible, low complexity, requiring only a low-privilege page-editor account with no user interaction or special attack timing. The key risk multiplier in real deployments is the delegation model - Grav is frequently deployed for multi-author sites where content editors are granted admin.pages without super-admin rights, precisely the account class this vulnerability weaponizes. The read primitive allows disclosure of server-readable files (database credentials, .env files, SSH keys) to anonymous visitors via crafted pages, compounding the integrity risk. No EPSS score was provided in the intelligence feed, and the vulnerability is not in CISA KEV at time of analysis, suggesting exploitation has not been observed at scale. However, the low attack complexity and the availability of gadget methods within PHP's standard library and the Grav framework make this straightforwardly exploitable once an attacker controls a page-editor account. The absence of availability impact (VA:N) is consistent with the described primitives, which do not include deletion. This is a genuine priority for any multi-user Grav deployment.

An attacker with a page-editor account (admin.pages) crafts a Grav page whose YAML frontmatter defines a form field using a dynamic-field directive pointing to a built-in PHP static method such as file_get_contents::/etc/passwd with the target file as a controlled argument. When an anonymous visitor loads the crafted page, Grav evaluates the blueprint and invokes the method, rendering the file contents in the page output. Using the same mechanism with file copy or directory creation gadgets, the attacker can stage a PHP web shell in a web-accessible path, escalating from file read to persistent code execution under the web-server account.