{"action":"Upgrade getgrav/grav to 2.0.9 or later.","affected":[{"fixed":"2.0.9","introduced":"1.7.0"}],"component":"getgrav/grav","cve_ids":["CVE-2026-65608"],"ecosystem":"Packagist","epss":0.01116,"exploited":false,"fixed_versions":["2.0.9"],"ghsa_id":"GHSA-c4wf-2xxc-68qm","id":"tcs_01M5KF0K3XACRQFYY5FA35XXJG","modified_at":"2026-09-17T17:30:07.521285796Z","published_at":"2026-09-17T17:15:33Z","references":["https://osv.dev/vulnerability/GHSA-c4wf-2xxc-68qm","https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm","https://nvd.nist.gov/vuln/detail/CVE-2026-65608","https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969","https://github.com/getgrav/grav","https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-flexdirectory"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-c4wf-2xxc-68qm","url":"https://osv.dev/vulnerability/GHSA-c4wf-2xxc-68qm"}],"summary":"Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation"}