https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 13:43:43 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-65608 <p>Grav versions &gt;= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.</p> <p>Grav versions &gt;= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-65608 https://vulnerability.circl.lu/vuln/ghsa-c4wf-2xxc-68qm <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A missing validation check in Grav&#39;s Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with `create` or `update` rights on a Flex-based directory (Flex Users, Flex Pages, Flex Objects, or any custom Flex type) can trigger it the moment a blueprint field anywhere in that directory carries a `data-*@:` directive, since the code that resolves those directives calls `call_user_func_array()` on attacker-influenced input with no restriction at all.</p> <p>This is a bypass of GHSA-fj2p-qj2f-74v5, already patched in 2.0.7. That fix added real validation to `Blueprint::dynamicData()`, but Grav&#39;s Flex system routes the same directive through a separate, unprotected method, `FlexDirectory::dynamicDataField()`, which never received the same fix.</p> <p>### Details</p> <p>Grav blueprints support `action-property@:` directives, YAML keys that tell the blueprint engine to compute a field&#39;s value dynamically by calling a function. `Blueprint::init()` (`system/src/Grav/Common/Data/Blueprint.php:167-177`) resolves these by checking for a registered handler first, and only falling back to the built-in `dynamic{Action}` method if none is registered:</p> <p>```php foreach ($data as $property =&gt; $call) { $action = $call[&#39;action&#39;]; $method = &#39;dynamic&#39; . ucfirst((string) $action); $call[&#39;object&#39;] = $this-&gt;object;</p> <p>if (isset($this-&gt;handlers[$action])) {…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A missing validation check in Grav&#39;s Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with `create` or `update` rights on a Flex-based directory (Flex Users, Flex Pages, Flex Objects, or any custom Flex type) can trigger it the moment a blueprint field anywhere in that directory carries a `data-*@:` directive, since the code that resolves those directives calls `call_user_func_array()` on attacker-influenced input with no restriction at all.</p> <p>This is a bypass of GHSA-fj2p-qj2f-74v5, already patched in 2.0.7. That fix added real validation to `Blueprint::dynamicData()`, but Grav&#39;s Flex system routes the same directive through a separate, unprotected method, `FlexDirectory::dynamicDataField()`, which never received the same fix.</p> <p>### Details</p> <p>Grav blueprints support `action-property@:` directives, YAML keys that tell the blueprint engine to compute a field&#39;s value dynamically by calling a function. `Blueprint::init()` (`system/src/Grav/Common/Data/Blueprint.php:167-177`) resolves these by checking for a registered handler first, and only falling back to the built-in `dynamic{Action}` method if none is registered:</p> <p>```php foreach ($data as $property =&gt; $call) { $action = $call[&#39;action&#39;]; $method = &#39;dynamic&#39; . ucfirst((string) $action); $call[&#39;object&#39;] = $this-&gt;object;</p> <p>if (isset($this-&gt;handlers[$action])) {…</p> https://vulnerability.circl.lu/vuln/ghsa-c4wf-2xxc-68qm