CyberRota Analysis
AI-GeneratedGrav CMS versions 2.0.7 to 2.0.10 are vulnerable due to inadequate validation of static method calls in blueprint dynamic-field directives, allowing users with page-editing rights to execute arbitrary public static PHP methods. This vulnerability can lead to unauthorized access to server-readable files and the ability to create or copy files and directories under the web server account. Organizations using affected versions should prioritize upgrading to 2.0.11 to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.