Grav is a file‑based web platform. In versions prior to 2.0.7, the function Blueprint::dynamicData() forwards editor‑controlled class and method names to call_user_func_array without filtering dangerous callbacks. An attacker with either admin.pages or api.pages.write permissions can use the arrayFilterRecursive helper as a trampoline, place an arbitrary system command in page front‑matter, and have that command executed as the web server user when the page is rendered. This flaw directly enables remote code execution under the web server’s privileges. The root weakness combines unchecked user input with code execution, falling under CWE‑94 (Code Injection).

Grav CMS – all 2.0.x releases prior to 2.0.7. Accounts with admin.pages or api.pages.write permissions are capable of exploiting the vulnerability. The vulnerability was fixed in 2.0.7, so any deployment running an older 2.0 release remains affected.

With a CVSS score of 8.7 the flaw is classified as high severity. The EPSS score of 0.00343% indicates a very low probability of exploitation, and it is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. However, the attack vector requires user authentication with page‑write or admin privileges, which many installations grant to site administrators. An attacker who gains such permissions can immediately trigger arbitrary code execution by crafting malicious front‑matter. While no public exploit is documented in the advisory, the technical details make the vulnerability highly exploitable in the right environment.