CVE-2026-69088

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69088", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-03T10:42:57.737Z", "datePublished": "2026-08-03T13:20:42.911Z", "dateUpdated": "2026-10-08T15:24:18.262Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:18.262Z"}, "datePublic": "2026-07-21T00:00:00.000Z", "title": "Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint", "descriptions": [{"lang": "en", "value": "Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "getgrav", "product": "grav", "defaultStatus": "unaffected", "versions": [{"version": "2.0.7", "status": "affected", "versionType": "semver", "lessThan": "2.0.11"}, {"version": "2.0.11", "status": "unaffected", "versionType": "semver"}], "packageURL": "pkg:composer/getgrav/grav"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.10:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.9:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.8:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.7:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.6:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.5:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:1.7.53.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:1.7.53.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.4:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.3:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.0:-:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc10:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc9:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:1.7.53:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc8:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc7:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc6:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc5:*:*:*:*:*:*"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-7pgq-cr25-xvc8)"}, {"name": "VulnCheck Advisory: Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/grav-cms-through-arbitrary-method-invocation-via-blueprint"}], "credits": [{"lang": "en", "value": "adamyordan", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T14:43:14.759133Z", "id": "CVE-2026-69088", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T14:47:10.574Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69088", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T14:43:14.759133Z"}}}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T14:47:04.011Z"}}], "cna": {"title": "Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint", "credits": [{"lang": "en", "type": "reporter", "value": "adamyordan"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "2.0.7", "lessThan": "2.0.11", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.11", "versionType": "semver"}], "packageURL": "pkg:composer/getgrav/grav", "defaultStatus": "unaffected"}], "datePublic": "2026-07-21T00:00:00.000Z", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8", "name": "GitHub Security Advisory (GHSA-7pgq-cr25-xvc8)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/grav-cms-through-arbitrary-method-invocation-via-blueprint", "name": "VulnCheck Advisory: Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav:2.0.10:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.9:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.8:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.7:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.6:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.5:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:1.7.53.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:1.7.53.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.4:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.3:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:-:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc10:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc9:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:1.7.53:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc8:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc7:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc6:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc5:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:18.262Z"}}}, "cveMetadata": {"cveId": "CVE-2026-69088", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:24:18.262Z", "dateReserved": "2026-08-03T10:42:57.737Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-03T13:20:42.911Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:composer/getgrav/grav", "product": "grav", "vendor": "getgrav", "versions": [{"lessThan": "2.0.11", "status": "affected", "version": "2.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.11", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11."}, {"lang": "es", "value": "Las versiones 2.0.7 a 2.0.10 de Grav CMS no validan las llamadas a m\u00e9todos est\u00e1ticos completamente cualificadas (Clase::m\u00e9todo) en las directivas de campo din\u00e1mico de \u2019blueprint\u2019 porque Blueprint::isSafeDynamicCall() solo aplica su lista de denegaci\u00f3n de invocables peligrosos a cadenas que no contienen \u2019::\u2019. Una cuenta con solo derechos de edici\u00f3n de p\u00e1gina (admin.pages, no super-admin o admin.pages_twig) puede plantar una directiva en el \u2019frontmatter\u2019 de campo de formulario de una p\u00e1gina que invoca un m\u00e9todo PHP est\u00e1tico p\u00fablico arbitrario con argumentos controlados por el atacante. Usando m\u00e9todos \u2019gadget\u2019 incorporados, esto permite la lectura de cualquier archivo legible por el servidor (revelado a visitantes an\u00f3nimos de la p\u00e1gina creada) y la creaci\u00f3n/copia arbitraria de archivos y directorios bajo la cuenta del servidor web. Corregido en 2.0.11."}], "id": "CVE-2026-69088", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69088", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T14:43:14.759133Z", "version": "2.0.3"}}]}, "published": "2026-08-03T14:16:29.253", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/grav-cms-through-arbitrary-method-invocation-via-blueprint"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.7,2.0.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.0.11"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "grav", "source": "cna", "vendor": "getgrav"}, "product": "grav", "vendor": "getgrav"}], "created": "2026-08-03T14:45:04.154440+00:00", "updated": "2026-08-04T10:30:07.264630+00:00", "vendors": ["getgrav", "getgrav$PRODUCT$grav"]}