CVE-2026-64850 getgrav CVE debrief

Who should care

Administrators and developers of Grav installations, especially those with untrusted users having admin or API write access, should assess exposure and apply the patch. They should verify Grav version, user access controls, and monitor for suspicious page frontmatter changes. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-64850 allows for remote code execution in Grav installations prior to version 2.0.7, with a CVSS score of 8.7. Administrators and developers should assess exposure, verify user access controls, and apply the patch.

• Remote code execution as the web server user
• Potential for command injection via page frontmatter
• Elevation of privileges for users with admin.pages or api.pages.write access
• Verification of Grav version and user access controls required

Technical summary

The dynamicData function in Grav's Blueprint.php allows for remote code execution when an attacker with admin.pages or api.pages.write access can manipulate the Class::method provider and arguments to call_user_func_array(). This can be exploited by placing a command in page frontmatter, which is then executed as the web server user when the page is viewed. The issue is fixed in version 2.0.7, which rejects dangerous callback parameters. Administrators and developers should assess exposure, verify user access controls, and apply the patch.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch from version 2.0.7
• Restrict access to admin.pages and api.pages.write
• Monitor for suspicious page frontmatter changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Grav, a file-based Web platform, which allows for remote code execution via the dynamicData function in Blueprint.php. The issue is fixed in version 2.0.7. Evidence is limited to public CVE and NVD records. Defenders should verify Grav version, user access controls, and page frontmatter for suspicious changes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.