THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-f8wv-xp27-6gq7 (critical) — Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

[GHSA] GHSA-f8wv-xp27-6gq7 (critical) — Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

medgithub_advisoriesPublished 2026-09-17

GHSA-f8wv-xp27-6gq7 Severity: critical CVE: CVE-2026-75827

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

## Affected versions and vulnerable location

- Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Sinks: - `system/src/Grav/Common/Data/Blueprint.php:455-458` `call_user_func_array($o, $params)` (bare-function dynamic-

Indicators of compromise

CVE-2026-75827cve
CVE-2026-64850cve

Original source: https://github.com/advisories/GHSA-f8wv-xp27-6gq7