{"action":"Upgrade getgrav/grav to 2.0.11 or later.","affected":[{"fixed":"2.0.11","introduced":"2.0.7"}],"component":"getgrav/grav","cve_ids":["CVE-2026-69088"],"ecosystem":"Packagist","epss":0.00295,"exploited":false,"fixed_versions":["2.0.11"],"ghsa_id":"GHSA-7pgq-cr25-xvc8","id":"tcs_01M5KEY9V2GKP0KFNNFCQ2TG1Y","modified_at":"2026-10-26T15:00:05.318682585Z","published_at":"2026-09-17T17:16:39Z","references":["https://osv.dev/vulnerability/GHSA-7pgq-cr25-xvc8","https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8","https://nvd.nist.gov/vuln/detail/CVE-2026-69088","https://github.com/getgrav/grav","https://www.vulncheck.com/advisories/grav-cms-through-arbitrary-method-invocation-via-blueprint","https://github.com/getgrav/grav/commit/446d7f8f255918c8234634fe1dc2c9c77a0c673e","https://github.com/getgrav/grav/releases/tag/2.0.11"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-7pgq-cr25-xvc8","url":"https://osv.dev/vulnerability/GHSA-7pgq-cr25-xvc8"}],"summary":"Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure"}