Which versions of Grav CMS are affected by CVE-2026-69088?

Grav CMS versions 2.0.7-2.0.10 contain a vulnerability allowing authenticated users with page-editing permissions to bypass access controls, read sensitive server files including database…. A patch is available.

How to fix or mitigate CVE-2026-69088?

Within 24 hours, identify all Grav CMS deployments running versions 2.0.7 through 2.0.10 and audit which users or service accounts hold admin.pages (page-editing) permissions, with particular focus on multi-tenant or shared hosting scenarios where privilege escalation risk is highest. Within 7 days, obtain and test the latest vendor-released Grav CMS patch in a staging environment, then deploy to production with appropriate change management procedures and full system backups. Within 30 days, verify deployment completion across all instances, conduct access control review to ensure admin.pages permissions are limited to authorized personnel only, and implement enhanced logging for file system access patterns via blueprint directives.

Grav CMS CVE-2026-69088

Q: What is the CVSS score of CVE-2026-69088?

CVE-2026-69088 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52281 HIGH

Code Injection (CWE-94)

2026-08-03 VulnCheck

GHSA-vj8j-973f-r65j

PHP RCE Code Injection Grav Getgrav

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable via CMS admin panel (AV:N), low complexity, requires page-editor account (PR:L), no UI needed; high C and I from file read/write primitives, no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 14:24 vuln.today

Patch available

Aug 03, 2026 - 14:02 EUVD

CVE Published

Aug 03, 2026 - 13:20 cve.org

HIGH 8.6

DescriptionCVE.org

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.

AnalysisAI

Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.

Technical ContextAI

Grav CMS (cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*) is a flat-file PHP CMS that uses a YAML-based Blueprint system to define form fields in page frontmatter. Blueprint dynamic-field directives support callable references to invoke PHP methods for things like field population or validation. The security guard Blueprint::isSafeDynamicCall() was designed to block dangerous callables, but its denylist logic contains a conditional: strings containing '::' - the PHP fully-qualified static method syntax (ClassName::methodName) - are exempted from the check entirely. This maps to CWE-94 (Improper Control of Generation of Code / Code Injection), specifically a logic bypass that permits an attacker to invoke any reachable public static PHP method with attacker-controlled arguments. Built-in PHP and framework gadget methods then serve as primitives for file read (e.g., file_get_contents) and file write/copy operations, exposing the impact without requiring a custom exploit payload.

RemediationAI

The primary fix is to upgrade Grav CMS to version 2.0.11, which corrects the Blueprint::isSafeDynamicCall() logic to apply the dangerous-callable denylist to all callable strings regardless of whether they contain '::'. The vendor advisory is at https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8. If immediate upgrade is not possible, the most effective compensating control is to revoke admin.pages access from all non-trusted accounts and audit existing pages for frontmatter containing '::' patterns in dynamic-field directives - this can be done by grepping YAML frontmatter across the pages directory. A secondary control is to restrict the web-server account's filesystem permissions to only the Grav installation directory, limiting the blast radius of the file-read and file-write primitives. Note that restricting the web-server account may affect legitimate Grav functionality such as plugin installation and cache writes. Blocking page-editor access entirely prevents exploitation but also eliminates the intended content-editing workflow.