CVE-2026-65608 getgrav CVE debrief

Who should care

Grav administrators and developers, especially those with Flex-based directories, should assess exposure and prioritize upgrading to version 2.0.9 or later. They should also restrict create and update permissions on Flex-based directories and monitor for suspicious activity on Flex directories.

Why it matters

CVE-2026-65608 is a high-severity remote code execution vulnerability in Grav versions >= 1.7.0 and before 2.0.9. Defenders should prioritize upgrading to version 2.0.9 or later and restrict create and update permissions on Flex-based directories.

• Potential for arbitrary shell command execution
• Bypass of validation added in 2.0.7
• Exposure of Flex-based directories to authenticated users
• Need for verification of affected versions and remediation

Technical summary

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability via FlexDirectory. An authenticated user with create or update permission on Flex-based directories can execute arbitrary shell commands. The vulnerability is caused by FlexDirectory::dynamicDataField() resolving blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec.

Defensive priority

High priority for Grav administrators and developers

Recommended defensive actions

• Upgrade to Grav version 2.0.9 or later
• Restrict create and update permissions on Flex-based directories
• Monitor for suspicious activity on Flex directories
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program and NVD records confirm a remote code execution vulnerability in Grav versions >= 1.7.0 and before 2.0.9. Vendor advisory and patch commit provide additional context. The vulnerability is caused by FlexDirectory::dynamicDataField() resolving blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Any authenticated user with create或u

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.