Description

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T12:19:32.553Z",
  "pubdate": "2026-08-18T12:19:32.553Z",
  "executiveSummary": "Grav before 2.0.15 is susceptible to an arbitrary file write vulnerability that leads to remote code execution. The security flaw resides in the Blueprint dynamic-data bare-function validation mechanism, which improperly relies on an incomplete denylist strategy rather than a strict positive allowlist. This architectural weakness allows malicious actors to leverage data directives to invoke the error_log function. Consequently, attackers can append arbitrary PHP code payloads directly into web-accessible files within the application directory.\nExploitation of this vulnerability requires specific attacker capabilities, namely page-edit or blueprint-config access within the Grav content management system. Successful execution permits authenticated users with low-to-moderate privileges to escalate their access to full remote code execution on the underlying server. Given the nature of arbitrary file writes in web application roots, the overall risk implication is critical, potentially compromising the complete confidentiality, integrity, and availability of the affected system.",
  "technicalDetails": "The vulnerability is fundamentally rooted in the Blueprint dynamic-data bare-function validation component of Grav before 2.0.15. During the processing of dynamic data configurations, the validation engine attempts to restrict dangerous function calls. However, it implements an incomplete denylist instead of a rigorous positive allowlist. This design flaw permits the invocation of sensitive PHP functions that should be strictly prohibited during data validation and sanitization phases.\nThe attack flow begins when an adversary with page-edit or blueprint-config access crafts a malicious request containing a crafted data directive. By targeting the error_log function or similar mechanisms exposed through the vulnerable bare-function validation, the attacker can manipulate internal logging or file-writing routines. Because the input validation fails to block this specific vector, the application processes the directive and writes the supplied data to target files.\nThe payload behavior involves appending arbitrary PHP code strings into web-accessible files, such as PHP scripts or templates located within the web root. Once the malicious payload is successfully written to a web-accessible location, the attacker can execute system commands or application-level logic by issuing HTTP requests directly to the modified file. This post-exploitation impact results in full remote code execution under the privileges of the web server process.\nPrerequisites for this attack include network exposure to the Grav administration or editing interfaces, along with valid authentication credentials granting page-edit or blueprint-config privileges. The affected component is constrained to versions of Grav prior to 2.0.15, where the incomplete denylist logic in the Blueprint dynamic-data validation is present."
}