What is CVE-2026-65008?
This vulnerability in Grav 2.0.4 allows remote code execution via the 'Blueprint::dynamicData()' function, which passes unsanitized callable strings directly to `call_user_func_array`. Attackers can exploit this through form plugin routes to execute arbitrary PHP code on the server. Users should immediately upgrade to Grav version 2.0.7 or later.
Azərbaycanca: Grav 2.0.4 versiyasında 'Blueprint::dynamicData()' funksiyasında aşkar edilmiş bu boşluq, təhlükəsizlik yoxlaması olmadan `call_user_func_array` çağırışı vasitəsilə uzaqdan kod icrasına (RCE) imkan verir. Bu, form plugin marşrutları üzərindən xüsusi hazırlanmış sorğular göndərən hücumçulara serverdə ixtiyari PHP kod işlətmək imkanı yaradır. Grav istifadəçiləri təcili olaraq 2.0.7 versiyasına və ya daha yuxarı versiyaya yeniləmə etməlidirlər.
Related CVEs
link basis: same weakness class CWE-94; shared vendor: Grav
FAQ2
Which function in Grav is exploited to trigger CVE-2026-65008?
The vulnerability is triggered via the 'Blueprint::dynamicData()' function, which passes unsanitized callable strings directly to `call_user_func_array`.
Which Grav version should users upgrade to in order to mitigate CVE-2026-65008?
Users should immediately upgrade to Grav version 2.0.7 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.