https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:55:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-69088 <p><strong>Affected:</strong> getgrav grav</p> <p>Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain &#39;::&#39;. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page&#39;s form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.</p> <p><strong>Affected:</strong> getgrav grav</p> <p>Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain &#39;::&#39;. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page&#39;s form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account. Fixed in 2.0.11.</p> https://vulnerability.circl.lu/vuln/cve-2026-69088