External risk intelligence

Grav Arbitrary File Write Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75827

Grav is a content management system (CMS) typically deployed as a public-facing web application. Since the vulnerability resides within the application's core functionality, it is commonly exposed to the internet in standard web hosting deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Grav, a content management system, that could allow unauthorized individuals to execute malicious code on affected systems. The issue stems from how the system handles certain data inputs, potentially enabling attackers to write arbitrary files.

Arbitrary file write allows code execution.
Matters if Grav is used for public-facing sites.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by manipulating data directives within the Grav CMS. If an attacker has the ability to edit pages or configure blueprints, they can use the `error_log` function to inject malicious PHP code into web-accessible files. This allows for remote code execution by appending arbitrary content to files.

Attacker needs page-edit or blueprint-config access.
Triggered by crafting a data directive with `error_log`.
Achieves remote code execution.

Live Threat

Current exploitation, exposure, and threat context

An arbitrary file write vulnerability in Grav could allow attackers with page-edit or blueprint-config access to achieve remote code execution. This occurs when the system's handling of dynamic data in blueprints fails to adequately sanitize input, enabling the injection of PHP code into web-accessible files. The consequence is the potential compromise of the affected web server.

Web server code execution
Via manipulated data directive
Server control and data access

Operational Fix

Recommended remediation, mitigation, and detection steps

The Grav CMS, particularly versions prior to 2.0.15, has a critical vulnerability that allows for remote code execution. This issue stems from insecure handling of data directives, enabling attackers with specific page-editing or blueprint-configuration access to write malicious PHP payloads to web-accessible files. Technical leaders, security teams, and system owners must prioritize identifying all Grav deployments, assessing their internet reachability and business criticality, and confirming the accountable application owner. Remediation planning should follow, considering maintenance windows and potential vendor coordination.

Application owners should address this vulnerability.
Verify Grav deployment reachability and criticality.
Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Grav and why is it used?

Grav is a flat-file content management system (CMS) that stores data in files rather than a database. Because it is file-based, it is often chosen for its speed and ease of deployment for websites. Users typically leverage it to manage web content, blogs, or documentation platforms where performance and simplicity are prioritized.

What is the vulnerability in CVE-2026-75827?

This vulnerability is classified as CWE-94: Improper Control of Generation of Code. In plain terms, Grav fails to properly restrict certain system functions within its configuration blueprints. Because it uses an incomplete denylist instead of a strict allowlist for validation, an attacker can trick the system into running the error_log function to write malicious PHP code into accessible files, leading to remote code execution.

How is this Grav vulnerability triggered?

An attacker must have specific existing permissions—specifically page-editing or blueprint-configuration access—to trigger the flaw. By manipulating data directives within these areas, they can invoke the error_log function to inject code. Importantly, this cannot be triggered by a standard, unauthenticated visitor; it requires an account with sufficient authorization to modify site configuration or content.

Do I need to worry about this CVE if my site is internal?

Halo Surface Signal indicates that Grav is commonly deployed as a public-facing web application, which significantly increases risk. If your instance is internal, the threat remains for authenticated users, but the likelihood of remote exploitation is lower than for internet-facing sites. You should assess if your Grav instance is reachable from the internet to determine your immediate risk profile.

What are the first steps to address CVE-2026-75827?

First, identify all Grav installations within your environment and verify their version numbers, as those before 2.0.15 are affected. Once you have an inventory, assess the business criticality and internet reachability of each instance. Finally, coordinate with your application owners to plan for updates, prioritizing those systems that are exposed to external traffic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.