{"uuid": "a626b7be-723e-4be9-b105-29ca04f0270b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75827", "type": "seen", "source": "https://gist.github.com/alon710/1cef33c0330b102b29081dbdebfcc5c4", "content": "# CVE-2026-75827: CVE-2026-75827: Grav Arbitrary File Write & Remote Code Execution\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75827\n\n## Summary\nAn arbitrary file write and remote code execution vulnerability exists in Grav CMS before version 2.0.15. The vulnerability is caused by using an incomplete denylist validation approach for bare PHP functions in the Blueprint dynamic-data compiler, allowing authenticated users with page-editing or blueprint-configuration privileges to execute arbitrary functions such as error_log.\n\n## TL;DR\nIncomplete denylist validation of bare PHP functions in Grav Blueprints allows authenticated users to trigger arbitrary file writes and achieve remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.8 (High)\n- **EPSS Score**: 0.00777\n- **Exploit Status**: PoC Verified\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS Core\n- **Grav CMS Core**: < 2.0.15 (Fixed in: `2.0.15`)\n\n## Mitigation\n\n- Upgrade Grav CMS Core to version 2.0.15 or later.\n- Audit page frontmatter files for unauthorized dynamic data directives.\n- Deploy Web Application Firewall (WAF) filtering on blueprint configurations.\n\n**Remediation Steps:**\n1. Identify and document all active Grav CMS installations and their current versions.\n2. Download and deploy Grav Core 2.0.15 or subsequent security releases.\n3. Run audit scripts to scan for unauthorized dynamic directives in existing pages.\n4. Enable provenance-based trust mechanisms by locking down writable page directory configurations.\n\n## References\n\n- [Grav CMS Advisory GHSA-f8wv-xp27-6gq7](https://github.com/getgrav/grav/security/advisories/GHSA-f8wv-xp27-6gq7)\n- [NVD CVE-2026-75827 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-75827)\n- [VulnCheck Vulnerability Advisory](https://www.vulncheck.com/advisories/grav-before-arbitrary-file-write-via-error-log)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75827) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T00:31:13.245503Z"}