CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.7 are vulnerable to a remote code execution flaw that allows authenticated users with specific permissions to inject malicious callable directives into page frontmatter. This vulnerability can lead to arbitrary code execution as the web-server user, impacting all users who access the affected pages, including unauthenticated visitors. Organizations using Grav for their web applications should prioritize patching to version 2.0.7 or later to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page.