Vulnerabilities

Vulnerability · CVE-2026-69088

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Published Sep 17, 2026 · catalog updated Oct 26, 2026 · Grav: Incomplete callable validation

Last checked Oct 29, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-69088. EPSS is 0.29%. Act only if a listed version of Grav: Incomplete callable validation is installed.

Severity

High8.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.29%

Remediation

Advisory link

Affected products

Packagist getgrav/grav

### Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified string, letting an account with only page-editing rights ( , not super-admin) plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this yields, at minimum, arbitrary reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. ### Details ( , method around line 488) is meant to block dangerous callables named in a blueprint's dynamic-field directives ( ). It only consults its dangerous-name denylist when the callable string does **not** contain : Any callable string containing — i.e. every static call — skips the check entirely and is passed to at ( , around line 461) and ( , around line 937). There is no allowlist restricting which classes or methods may be invoked this way; only the call's *arguments* are (separately) scanned for smuggled dangerous callables, never the target itself. ( ) classifies any string containing a colon ( ) or a namespace backslash as dangerous — so a qualified string would be rejected *if* it ever reached this function. The condition in ensures it never does, which is what leaves qualified static calls entirely unscreened. (Whether the exemption was intended to admit legitimate option-providers is a plausible reading of the surrounding code, but the intent is not established here.) This is an incomplete fix of two recently published advisories — one addressing page editors executing hidden callables via form-field settings, the other extending the same guard to Flex directories. The guard those fixes introduced never covered qualified static calls. Grav's own permission model separates page-content code execution into a distinct, higher privilege ( ) from plain page editing ( ), so invoking arbitrary methods fro