https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 18:39:15 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-11002 bdu:2026-11002 https://cve.radiocsirt.org/vuln/bdu:2026-11002 https://cve.radiocsirt.org/vuln/euvd-2026-343673 EUVD-2026-343673 https://cve.radiocsirt.org/vuln/euvd-2026-343673 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69088 <p>Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain &#39;::&#39;. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page&#39;s form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.</p> <p>Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain &#39;::&#39;. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page&#39;s form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-69088 https://cve.radiocsirt.org/vuln/ghsa-7pgq-cr25-xvc8 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary Grav CMS&#39;s blueprint dynamic-field callable guard can be bypassed with a fully-qualified `Class::method` string, letting an account with only page-editing rights (`admin.pages`, not super-admin) plant a directive in a page&#39;s form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this yields, at minimum, arbitrary reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account.</p> <p>### Details `Blueprint::isSafeDynamicCall()` (`system/src/Grav/Common/Data/Blueprint.php`, method around line 488) is meant to block dangerous callables named in a blueprint&#39;s dynamic-field directives (`data-*@`). It only consults its dangerous-name denylist when the callable string does **not** contain `::`: ```php if (is_string($function) &amp;&amp; !str_contains($function, &#39;::&#39;) &amp;&amp; Utils::isDangerousFunction($function)) { return false; } ``` Any callable string containing `::` — i.e. every `Class::method` static call — skips the check entirely and is passed to `call_user_func_array()` at `Blueprint::dynamicData()` (`Blueprint.php`, around line 461) and `FlexDirectory::dynamicDataField()` (`system/src/Grav/Framework/Flex/FlexDirectory.php`, around line 937). There is no allowlist restricting which classes or methods may be invoked this way; only the call&#39;s *arguments* are (separately) scanned for sm…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary Grav CMS&#39;s blueprint dynamic-field callable guard can be bypassed with a fully-qualified `Class::method` string, letting an account with only page-editing rights (`admin.pages`, not super-admin) plant a directive in a page&#39;s form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this yields, at minimum, arbitrary reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account.</p> <p>### Details `Blueprint::isSafeDynamicCall()` (`system/src/Grav/Common/Data/Blueprint.php`, method around line 488) is meant to block dangerous callables named in a blueprint&#39;s dynamic-field directives (`data-*@`). It only consults its dangerous-name denylist when the callable string does **not** contain `::`: ```php if (is_string($function) &amp;&amp; !str_contains($function, &#39;::&#39;) &amp;&amp; Utils::isDangerousFunction($function)) { return false; } ``` Any callable string containing `::` — i.e. every `Class::method` static call — skips the check entirely and is passed to `call_user_func_array()` at `Blueprint::dynamicData()` (`Blueprint.php`, around line 461) and `FlexDirectory::dynamicDataField()` (`system/src/Grav/Framework/Flex/FlexDirectory.php`, around line 937). There is no allowlist restricting which classes or methods may be invoked this way; only the call&#39;s *arguments* are (separately) scanned for sm…</p> https://cve.radiocsirt.org/vuln/ghsa-7pgq-cr25-xvc8