Grav CMS versions 2.0.7 through 2.0.10 allow an attacker who can edit a page’s front‑matter to inject a directive that calls any public static PHP method with attacker‑controlled arguments. The validation flaw in Blueprint::isSafeDynamicCall() neglects calls that contain the ‘::’ separator, thus permitting arbitrary method execution. By leveraging built‑in gadget methods, an attacker can read any server‑ readable file and create or copy files and directories under the web‑server account, effectively achieving full code execution on the host.

The vulnerability impacts all releases of Grav CMS from 2.0.7 to 2.0.10 inclusive, covering all minor version increments within that range. The affected vendor is getgrav for the Grav CMS product.

The CVSS score of 8.6 marks this flaw as high severity. EPSS information is not available, so the current exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog. Attackers must first obtain page‑editing privileges (admin.pages) to exploit this vector, which likely requires a valid user account or exploitation of another login or privilege escalation flaw. Given the capability to execute arbitrary public static methods and manipulate files, the success of such an attack would allow unauthorized code execution and data theft, posing a significant threat to confidentiality, integrity, and availability of affected deployments.