CVE-2026-69088

This CVE exposes a fundamental trust boundary failure in Grav CMS: the blueprint system's `isSafeDynamicCall()` method only blocks dangerous method calls when they lack the `::` separator. Fully-qualified static method calls like `Class::method()` bypass the denylist entirely, while shorter references like `method()` remain blocked. That's an inverted security model — the check was architected for one syntax pattern and fails silently against another that's semantically equivalent. The privilege escalation path is the critical part. An account with only `admin.pages` permissions — typically content editors — can inject a malicious directive into page frontmatter. That payload executes when ANY anonymous visitor loads the crafted page. You're looking at a low-privilege insider who can reach into the web-server account's file system without admin credentials, weaponizing every un-authenticated request against your infrastructure. The weaponizable gadgets are PHP's built-in methods: `file_get_contents()` for arbitrary file reads (exposing config files, database credentials, SSH keys, environment variables) and file/directory creation methods enabling webshell injection or critical file modification. One crafted page, served to anonymous visitors, becomes a compounding exfiltration and persistence vector. The fix in version 2.0.11 needs scrutiny. If it was a narrow regex addition catching `::` syntax, treat it as a temporary measure — new gadget classes or syntax variants will bypass it. The structural question is whether Grav eliminated dynamic method resolution from frontmatter entirely or merely hardened the denylist. Given the partial-denylist pattern has been exploited in Apache Struts2, WordPress plugins, and PHP's `assert()` across two decades, narrow patches in this category consistently fail within a few product cycles. For defenders: audit your frontmatter templates and blueprint configurations for any dynamic method references, regardless of syntax. If your deployment supports multi-tenancy or agency hosting, treat one tenant's editor compromise as a cross-tenant intrusion vector — the same server serves other customers' sensitive data. Monitor for anomalous file access patterns on anonymous requests, not just admin activity. Prioritize the 2.0.11 update but recognize the architectural risk remains until the callable-resolution pipeline is fundamentally redesigned.

Reviewed through automated stages and approved by a human before publication.