Grav 2.0.4 allows an attacker with administrative page write permissions to embed a callable string in a page’s frontmatter, which the Blueprint::dynamicData() function then passes directly to call_user_func_array(). The absence of an allowlist enables the execution of arbitrary PHP code on the web‑server user, resulting in full remote code execution.

The vulnerability affects all installations of Grav CMS version 2.0.4 and earlier, including the default distribution from getgrav:grav. Users running any pre‑2.0.7 release are susceptible.

The CVSS score of 9.3 reflects a critical impact. Even though the EPSS score is below 1% and the issue is not listed in CISA KEV, the combination of an authenticated vulnerability that can be activated by unauthenticated visitors makes it a high‑risk target. An attacker only needs to be allocated the admin.pages or api.pages.write privilege to inject the malicious directive, after which any visitor to the modified page will trigger code execution on the server. The attack vector is authenticated privilege escalation followed by passive exploitation via normal page access.