CVE-2026-75827 — Vulnerability intelligence
getgrav — grav
Published:
- CVSS
- 9.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.