Grav 2.0.4 Remote Code Execution Vulnerability Under Investigation
Grav 2.0.4 is under investigation for a critical remote code execution vulnerability that affects versions prior to 2.0.7.
What happened
Grav 2.0.4 reportedly contains a remote code execution vulnerability in the Blueprint::dynamicData() method, tracked as CVE-2026-65008. This vulnerability allows an authenticated attacker with admin.pages or api.pages.write permissions to execute arbitrary commands as the web-server user. The vulnerability is present in versions prior to 2.0.7. It is recommended to upgrade to Grav 2.0.7 or later to mitigate the risk.
The vulnerability arises from the improper handling of callable strings and arguments in the Blueprint::dynamicData() method. An authenticated attacker can exploit this by planting a malicious callable directive in a page, which then executes as the web-server user when the page is accessed.
For more detailed information, consult the primary sources: [CVE-2026-65007](https://nvd.nist.gov/vuln/detail/CVE-2026-65007) and [CVE-2026-65008](https://nvd.nist.gov/vuln/detail/CVE-2026-65008).
How 0Day mitigates this
grav is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.