Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.
| CVE | [CVE-2026-75827]( · [CVE.org]( |
| CWE | [CWE-94]( |
| CVSS | **High: 8.8** `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| Product | [grav]( |
| Affected | all versions **through 2.0.13** (inclusive) |
| Lab | `127.0.0.1` only · vendor/client disclosure pack, not a scanner |
Arbitrary file write is error_log via data-options@ in a form blueprint, not an upload action=. HTTP is GET /poc-form then GET /poc-witness.txt.
- **Router:** Public form page whose blueprint has data-options@: ['error_log', witness, 3, poc-witness.txt]. Form plugin Blueprint::getBlueprint() → dynamicData → call_user_func_array('error_log', ...). Page-edit (lab seed) placed the directive; GET triggers the write. Then GET /poc-witness.txt.
- **Notes:** CVE-2026-75827 CWE-94: Grav <=2.0.14 Blueprint::isSafeDynamicCall() bare-function branch uses Utils::isDangerousFunction denylist; error_log is omitted. 2.0.15 allowlists bare functions. Witness is POCWitness75827 in GET /poc-witness.txt (error_log append, not a shell). Do not write system()/exec() PHP.
- `Lab seed: admin user + Form plugin + page 03.poc-form with data-options@: error_log`
- `GET /poc-form → Form::getBlueprint() → Blueprint::dynamicData → isSafeDynamicCall('error_log') true → error_log(witness, 3, poc-witness.txt)`
- `GET /poc-witness.txt → POCWitness75827`
- Grav 2.0.13 admin skeleton (form plugin enabled)
- Page /poc-form with data-options@: ['error_log', 'POCWitness75827\n', 3, 'poc-witness.txt']
- Web root writable so error_log can create poc-witness.txt
- Admin labadmin/labadmin exists (page-edit); GET of the form is the sink
GET /poc-witness.txt body contains POCWitness75827. HTML or empty 404 is not the file-write witness.
- generic 200 Grav HTML without the witness file
**Do this first:** Update **grav** to **2.0.15 or newer**.
- Re-run `CVE-2026-75827-Abraxas-Labs.py` against the patched build: the mapped witness must **not** appear.
- Confirm the vendor advisory / changeset in the deployed tree (see references).
- Disable or isolate the affected component.
- Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).
Target **only** ` (or the loopback you bound). Do not point this script at the internet.
Success is the **witness** above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a `Dockerfile` in this folder builds from source.
- [`lab/docker-compose.yml`](lab/docker-compose.yml)
- [`lab/docker-compose.override.yml`](lab/docker-compose.override.yml)
Bind the vulnerable product tree to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except `127.0.0.1`.
- [CVE-2026-75827 · NVD](
- [CVE-2026-75827 · CVE.org](
- [github.com/getgrav/grav/security/advisories/GHSA-f8wv-xp27-6gq7](
- [
- [github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75827.json](
- [nvd.nist.gov/vuln/detail/CVE-2026-75827](
- [github.com/advisories/GHSA-f8wv-xp27-6gq7](
- Abraxas Labs: [abraxaslabs.tech]( · [github.com/abraxas]( · [@abraxas_null](
- input: `
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.
- getgrav grav 0 affected, 2.0.15 unaffected
-
-
-
-
-
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
## Affected versions and vulnerable location
- Confirmed on grav core at `78ebfc1` (tag 2.0.13).
- `system/src/Grav/Common/Data/Blueprint.php:455-458` `call_user_func_array($o, $params)` (bare-function dynamic-data provider).
- Twin: `system/src/Grav/Framework/Flex/FlexDirectory.php:936-938` `call_user_func_array($function, $params)`.
- Validation gate: `Blueprint::isSafeDynamicCall()` at `Blueprint.php:514-536`.
- `Class::method` branch (`:514-527`) uses a strict positive allowlist `self::$allowedDynamicCallables`.
- Bare-function branch (`:530-534`) uses only a denylist: `if (is_string($function) && Utils::isDangerousFunction($function)) return false; return !self::paramsContainDangerousCallable($params);`.
- Denylist: `Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`, list around `:2020-2270`).
GHSA-7pgq/CVE-2026-64850 hardened the `Class::method` half of the dynamic-callable validation to a positive allowlist because a page-edit account could otherwise name any static method as a provider and reach file/secret gadgets. The bare-function half was left on a denylist (`isDangerousFunction`). Any bare PHP function not on that list executes.
`error_log` is not on the denylist (verified: no occurrence in `Utils.php`). `error_log($message, 3, $destination)` appends attacker-controlled `$message` to attacker-controlled file `$destination`, an arbitrary-file-append primitive. `paramsContainDangerousCallable()` (`:587-603`) only scans params for dangerous callable strings, so a PHP payload string and a destination path both pass. (`stream_socket_client`, `dl`, and `mb_send_mail` are likewise absent, giving SSRF/other primitives.)
The same surface the published dynamic-data advisories accept as reachable: a `data-*@` directive in a form blueprint the Form plugin assembles from page frontmatter (GHSA-fj2p), or a `data@` field in a Flex directory/pages/users blueprint (GHSA-c4wf). A page-edit / blueprint-config account, no shell.
1. Author a blueprint field with a bare-function data directive, e.g.
`data-options@: ['error_log', '', 3, 'user/data/x.php']`.
2. `Blueprint::init()` resolves the directive; `isSafeDynamicCall('error_log', $params)` reaches the bare-function branch (`:530`), `isDangerousFunction('error_log')` is false, `paramsContainDangerousCallable([...])` is false (no callable strings),
This pack is for **the vendor, the site owner, and licensed labs**. The script talks to `127.0.0.1`. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
