High severity8.8NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026
CVE-2026-75827
CVE-2026-75827
Description
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
getgrav/gravPackagist | < 2.0.15 | 2.0.15 |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
2- Grav CMS: 14 Vulnerabilities Including Critical Privilege Escalation Disclosed TogetherVypr Intelligence · Aug 19, 2026
- Grav CMS: Six Vulnerabilities Including File Write and XSS Disclosed TogetherVypr Intelligence · Aug 18, 2026