Which versions of Grav CMS are affected by EUVD-2026-48244?

Grav CMS versions 1.7.0 through 2.0.8 contain a remote code execution vulnerability allowing authenticated users with directory management permissions to execute arbitrary server commands.. A patch is available.

How to fix or mitigate EUVD-2026-48244?

Within 24 hours: Inventory all Grav CMS instances and identify which are running versions 1.7.0-2.0.8; audit all user accounts holding create or update permissions on Flex-based directories. Within 7 days: Immediately restrict create and update permissions on Flex-based directories to only essential trusted administrators; revoke permissions from content editors and other non-administrative roles; implement multi-factor authentication for accounts retaining these permissions; enable detailed audit logging of directory modifications and server command execution. Within 30 days: Monitor official Grav CMS security advisories for vendor-released patches targeting version 2.0.9 or later; plan and execute immediate upgrades upon availability.

Grav CMS EUVD-2026-48244

Q: What is the CVSS score of EUVD-2026-48244?

EUVD-2026-48244 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-65608 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-07-23 disclosure@vulncheck.com

GHSA-pp9r-ppc4-25w4

RCE

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable authenticated user with Flex create/update rights (PR:L) reliably triggers OS command execution with no interaction, giving full C/I/A impact within the server scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Source Code Evidence Fetched

Jul 23, 2026 - 12:50 vuln.today

Analysis Generated

Jul 23, 2026 - 12:50 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 8.7

DescriptionCVE.org

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.

AnalysisAI

Remote code execution in Grav CMS (>= 1.7.0, < 2.0.9) allows any authenticated user holding create or update permission on any Flex-based directory to run arbitrary shell commands on the server. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives through call_user_func_array() while checking only is_callable(), so dangerous functions like exec, system, passthru, and shell_exec are never blocked. This re-opens the same class of flaw that GHSA-fj2p-qj2f-74v5 patched in Blueprint::dynamicData() (2.0.7), because the FlexDirectory handler bypasses that fix. No public exploit identified at time of analysis, though the issue was reported by VulnCheck with a dedicated advisory.

Technical ContextAI

Grav is a PHP-based flat-file CMS whose admin/data layer uses 'Flex Objects' - a framework for defining and editing structured content (Flex Users, Flex Pages, Flex Objects, and custom Flex types) via YAML blueprints. Blueprints support dynamic 'data-*@:' directives that map a field to a PHP callable at render/resolve time. The vulnerable path is FlexDirectory::dynamicDataField(), which passes attacker-influenced directive input into call_user_func_array() and gates it only with is_callable(). is_callable() returns true for any built-in PHP function, including OS command execution wrappers, so the guard does not distinguish safe accessors from dangerous system calls. This maps to CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / unsafe reflection): the choice of function to invoke is derived from untrusted blueprint data. Notably, FlexDirectory registers this handler for every Flex directory, so the previously added validation in Blueprint::dynamicData() (2.0.7) is bypassed entirely.

RemediationAI

Vendor-released patch: 2.0.9 - upgrade all Grav installations to 2.0.9 or later (release commit https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969), and review GHSA-c4wf-2xxc-68qm for the authoritative fix details. Until patching is possible, reduce the privilege surface by auditing and revoking create/update permissions on Flex directories from any account that does not strictly need them, since exploitation depends on that permission; expect this to disable legitimate content editing for those roles. As additional compensating controls, restrict admin panel and Flex-editing endpoints to trusted IPs or VPN, place the site behind a WAF that inspects blueprint/form submissions for data-*@: directives referencing exec/system/passthru/shell_exec, and enforce PHP disable_functions to block those OS-execution wrappers at the interpreter level - noting that disable_functions may break plugins or themes that legitimately shell out. Do not rely on these mitigations as a substitute for upgrading, as the core call_user_func_array() flaw remains.