Grav CMS EUVD-2026-60591

Exploitation requires the attacker to already possess page-edit or blueprint-config access in Grav, and the target install must be running a version before 2.0.15 where the bare-function validation uses the incomplete denylist. The concrete primitive is invoking the PHP error_log function via a Blueprint dynamic-data directive to append a PHP payload to a file that is reachable and executable under the web server's document root. Limiting factors: it is not usable by fully anonymous users - a privileged editor/config role is needed despite the input vector's PR:N - and success depends on a web-accessible, PHP-executing target directory being writable through the directive. The provided CVSS PR:N conflicts with this description-stated privilege requirement and should be verified with the vendor.

The supplied CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores this as critical and unauthenticated, but this directly conflicts with the description, which states the attacker must already have page-edit or blueprint-config access - i.e. some authenticated/privileged role. This PR:N-versus-privileged discrepancy should be verified with the vendor; a more defensible assessment treats it as requiring low privileges (PR:L). Even downgraded, the real-world impact is high: an authenticated content editor or anyone able to modify blueprint config can achieve full RCE with high confidentiality, integrity, and availability impact and no user interaction. There is no EPSS score, KEV listing, or public POC provided, so exploitation probability signals are absent; the risk is therefore driven by the severity of the primitive and the plausibility of insider/compromised-editor abuse rather than by evidence of mass exploitation. Bottom line: a genuine priority patch for any multi-user Grav deployment, but the 'unauthenticated' framing of the raw vector overstates reachability against installs where editing is restricted.

A user with a content-editor account (or access to blueprint configuration) crafts a Blueprint data directive that invokes the error_log function, passing a PHP payload and targeting a web-accessible file path. Grav's incomplete denylist permits the call, appending the PHP code to the file; the attacker then requests that file through the web server to execute their code and obtain RCE. No public exploit code was provided with this analysis, though the technique is straightforward given editor access.