The vulnerability allows an attacker to execute arbitrary shell commands on the server because FlexDirectory::dynamicDataField() blindly calls attacker-controlled functions via call_user_func_array when parsing blueprint directives. Only a generic callable check is performed; dangerous functions remain usable. This results in full remote code execution with the privileges of the authenticated user.

Affected are Grav CMS versions 1.7.0 up to but excluding 2.0.9. Any Flex-based directory (Flex Users, Flex Pages, Flex Objects or custom Flex types) is vulnerable. The vulnerability is present in the Grav package maintained by getgrav.

The CVSS score of 8.7 indicates high severity. The EPSS score is reported as less than 1%, implying a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, any authenticated user with create or update rights on any Flex directory can trigger the flaw. The attack graph does not require special network exposure; once authenticated, the attacker can run any shell command.