Grav CMS Arbitrary File Write Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- composer/getgrav/grav (packagist)
- Patched version
- 2.0.15
An early warning has been issued for a critical vulnerability in Grav CMS versions before 2.0.15. This vulnerability could allow attackers with page-edit or blueprint-config access to achieve remote code execution.
What happened
An arbitrary file write vulnerability has been reported in Grav CMS versions before 2.0.15. This vulnerability exists in the Blueprint dynamic-data bare-function validation, which uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can exploit this by invoking the error_log function through a data directive to append PHP payloads to web-accessible files, potentially achieving remote code execution.
The vulnerability was first flagged on August 18, 2026, and is tracked under the IDs GHSA-FWWX-3362-3947 and GHSA-F8WV-XP27-6GQ7. It has not yet been exploited in the wild, and there is no evidence of a supply-chain attack at this time. The affected component is composer/getgrav/grav (packagist).
What to do about it
- Upgrade to Grav version 2.0.15 or later to mitigate the arbitrary file write vulnerability.
- Review your Grav CMS configurations to ensure that only trusted users have page-edit or blueprint-config access.
- Monitor the primary sources for updates on this vulnerability.
- Consider implementing additional security measures to restrict access to sensitive functions and files.
How 0Day would have caught this
composer/getgrav/grav is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Grav CMS version before 2.0.15, you are potentially affected by this vulnerability.
What should I do right now?
Upgrade to Grav version 2.0.15 or later to mitigate the vulnerability. Review your configurations and monitor the primary sources for updates.
Has this vulnerability been exploited in the wild?
No, there is no evidence that this vulnerability has been exploited in the wild at this time.