Which versions of Grav CMS are affected by EUVD-2026-46183?

Grav CMS version 2.0.4 contains a critical remote code execution vulnerability affecting administrative users with specific page editing permissions.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-46183?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46183. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate EUVD-2026-46183?

Within 24 hours, identify all Grav CMS 2.0.4 instances in your environment and audit which users hold admin.pages or api.pages.write permissions. Within 7 days, immediately revoke these permissions from users who do not require them, implement strict access controls, and audit all page content for suspicious frontmatter patterns containing Class::method directives. Within 30 days, upgrade to Grav CMS 2.0.7 or later when the patched version is available, and conduct a full security review of affected pages.

Grav CMS EUVD-2026-46183

Q: What is the CVSS score of EUVD-2026-46183?

EUVD-2026-46183 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-65008 CRITICAL

Code Injection (CWE-94)

2026-07-21 VulnCheck

GHSA-3q93-h5p2-5mx8

PHP RCE Code Injection Grav Getgrav

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Injection requires the elevated admin.pages/api.pages.write permission so PR:H; network-reachable simple callable sink gives AC:L, and full code execution yields C/I/A High with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 13:17 EUVD

Analysis Generated

Jul 21, 2026 - 12:32 vuln.today

CVE Published

Jul 21, 2026 - 11:39 cve.org

CRITICAL 9.3

DescriptionCVE.org

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone - including an unauthenticated visitor - accesses the page.

Articles & Coverage 2

News 5 New PHP Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026 News Critical RCE in Grav CMS 2.0.4 via PHP Callable Injection - CVE-2026-65008 Jul 21, 2026

AnalysisAI

Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages.write permission plant a malicious Class::method callable directive in page frontmatter, which Blueprint::dynamicData() feeds unfiltered into call_user_func_array(). The injected command then executes as the web-server user for any subsequent visitor to the page, including unauthenticated ones. Reported by VulnCheck (CWE-94, CVSS 4.0 base 9.3); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Grav is a PHP-based flat-file content management system (cpe:2.3:a:getgrav:grav). The root cause is CWE-94 (Code Injection): Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php accepts a callable expressed as a 'Class::method' string plus arguments and dispatches it straight to PHP's call_user_func_array() with no allowlist or type restriction on which classes or methods may be invoked. Because the form plugin routes page frontmatter through the blueprint dynamic-data resolution path, attacker-controlled frontmatter becomes an attacker-controlled callable. This converts a data-binding mechanism into an arbitrary-code-execution primitive whenever the affected page is rendered.

RemediationAI

Vendor-released patch: upgrade to Grav 2.0.7 or later, which introduces restrictions on the callable resolution path; this is the primary and recommended fix, per advisory GHSA-fj2p-qj2f-74v5 (https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5). If immediate patching is not possible, tighten the trust boundary that gates the attack: audit and minimize accounts holding admin.pages and api.pages.write so only fully trusted operators can create or edit pages, and disable or restrict the admin panel and Pages API to trusted networks - trade-off is reduced content-editing convenience and possible workflow disruption for delegated editors. Additionally, review existing pages for unexpected callable/Class::method directives in frontmatter, and run the web server under a least-privileged account to limit the blast radius of any code that does execute.