Main Vulnerability Database Vulnerabilities #VU138919

Code Injection in Grav CMS - CVE-2026-69088

Published: July 21, 2026 / Updated: September 14, 2026

Vulnerability identifier: #VU138919

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-69088

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incomplete callable validation in blueprint dynamic fields. A remote user can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Grav CMS

How to mitigate CVE-2026-69088

Install updates from vendor's website.

Grav CMS - update to 2.0.11

Links to Public Exploits and PoC-codes

Exploit #12833 - Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure (July 21, 2026)

External References

https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8

Related Security Bulletins

Multiple vulnerabilities in Grav CMS