CVE-2026-65608

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.

• CWE-470

• https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969
• https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm
• https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-flexdirectory
• https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm

Published

Jul 23, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65602Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to…8.8
• CVE-2026-65603The Grav Login plugin (grav-plugin-login) versions <= 3.8.11…8.8
• CVE-2026-65604Skipper contains an incomplete fix for CVE-2026-50197 in whi…8.8
• CVE-2026-65605SiYuan before v3.7.2 contains a stored cross-site scripting …9.6
• CVE-2026-65606SiYuan before v3.7.2 contains a cross-site scripting vulnera…9.6
• CVE-2026-65607SiYuan before v3.7.2 contains a path traversal vulnerability…7.1
• CVE-2026-65609nnn is vulnerable to Out-of-Bound write vulnerability. Due t…2.4
• CVE-2026-6561A vulnerability was detected in EyouCMS up to 1.7.1. This is…4.7
• CVE-2026-65610nnn stores homelen variable as uchar_t, which can only repre…2.4
• CVE-2026-65611nnn does not sanitize the path variable. An attacker can cre…5.1
• CVE-2026-65612nnn does not sanitize the filename variable. An attacker can…5.1
• CVE-2026-65613Exposure of Sensitive Information to an Unauthorized Actor v…4.3