PatchSiren cyber security CVE debrief
CVE-2026-65008 getgrav CVE debrief
CVE-2026-65008 is a remote code execution vulnerability in Grav 2.0.4, which was fixed in version 2.0.7. The vulnerability exists in the Blueprint::dynamicData() method, where a Class::method callable string and its arguments are passed directly to call_user_func_array() without any allowlist. This allows an authenticated account with the admin.pages (or api.pages.write) permission to plant a malicious callable directive in a page, which can then be executed as the web-server user when accessed by any user, including unauthenticated visitors. Administrators and users of Grav 2.0.4 should be aware of this vulnerability and take immediate action to upgrade to version 2.0.7 or apply necessary patches.
- Vendor
- getgrav
- Product
- grav
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Administrators and users of Grav 2.0.4, as well as operators, platforms, vulnerability-management teams, and security teams, should be aware of this vulnerability and take immediate action to upgrade to version 2.0.7 or apply necessary patches.
Technical summary
The vulnerability exists in the Blueprint::dynamicData() method, where user-input data is not properly sanitized before being passed to call_user_func_array(). This allows an attacker to inject malicious code, which can be executed as the web-server user. The vulnerability requires authentication with the admin.pages or api.pages.write permission to exploit. Affected product deployments should be identified and owners assigned for follow-up.
Defensive priority
High
Recommended defensive actions
- Upgrade Grav to version 2.0.7 or later
- Restrict access to the admin.pages and api.pages.write permissions
- Monitor page creation and editing activities
- Implement additional security measures, such as web application firewalls and intrusion detection systems
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-21T12:19:01.183Z and last modified on 2026-07-22T15:17:21.973Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD information. Defenders should verify affected Grav deployments, review official advisories, and monitor for potential exploitation attempts.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T12:19:01.183Z and has not been modified since then. The NVD entry is currently Deferred.