External risk intelligence

Grav Blueprint DynamicData Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65008

Grav is a content management system designed to serve web content to public users. Since the vulnerability is triggered by accessing a page frontmatter, it is commonly exposed as an internet-facing web application.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a remote code execution vulnerability within the Grav content management system. The flaw, located in the Blueprint component, allows for the execution of arbitrary commands as the web server user when specific conditions are met, potentially impacting any page accessed through the system.

Malicious code can run via crafted page content.
This impacts public-facing websites using Grav.
Confirm if your Grav installation is affected.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to manage pages can inject a malicious command into a page's configuration. This command, when executed by the `Blueprint::dynamicData()` function, allows arbitrary code to run on the server. Anyone, including unauthenticated visitors, who accesses the compromised page will trigger the execution of this malicious code, potentially leading to a full system compromise.

Authenticated access to page management.
Accessing a crafted page triggers code execution.
Remote code execution as web server user.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated user to execute arbitrary code on the server when a page is accessed. This could affect the integrity and availability of the web server, as well as any data it processes or stores.

Server-side code execution.
Malicious directive in page frontmatter.
Server compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Grav CMS administrators, application owners, and platform teams are likely responsible for addressing this vulnerability. The immediate first step is to identify all instances of Grav CMS, confirm their exposure and criticality, and then coordinate remediation efforts with the accountable owners.

Ownership: Grav CMS administrators and application owners.
Verify first: Identify Grav CMS instances and their reachability.
Action: Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Grav CMS?

Grav is a flat-file content management system. It does not require a database, instead storing content in simple files that the system processes to serve web pages to visitors. It is popular for its speed and simplicity in building websites, ranging from personal blogs to complex documentation portals.

How does CVE-2026-65008 enable remote code execution?

This vulnerability is an instance of Improper Control of Generation of Code, or CWE-94. The software incorrectly handles dynamic data by passing user-supplied input directly to a function that executes code. Because the application fails to restrict which functions or methods can be called, an attacker can craft specific input that forces the server to run unintended commands.

What must happen for this vulnerability to be triggered?

An attacker needs existing administrative access to the Grav platform to modify page frontmatter. Once the malicious directive is planted, the code is not triggered by the attacker's administrative session alone. Instead, it executes automatically whenever the affected page is loaded by any user, including standard, unauthenticated visitors browsing the public website.

Is my Grav instance at risk?

According to Halo Surface Signal, Grav is a web-based platform typically intended to be internet-facing to serve content to the public. If your instance is accessible over the internet, it is more likely to be reached by unauthorized requests. You should consider any installation that allows page creation and is reachable by outside traffic to be at higher risk.

How should I respond to this advisory?

Prioritize identifying all deployed Grav instances in your environment. Confirm the current version of each installation to see if it falls within the affected range. Coordinate with your team to plan an update to a patched version, as this is the only way to remove the underlying flaw in the Blueprint component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.