CVE-2026-64850

You need to understand what CVE-2026-64850 actually represents before you decide how to prioritize it. The CVSS 8.7 rating captures the impact accurately, but it obscures something more important: this isn't a traditional deserialization vulnerability. The actual mechanism—abusing `arrayFilterRecursive()` in Grav's `Utils.php` to invoke PHP built-ins like `system` as callbacks—exploits the framework's own API design rather than introducing malicious gadgets. Your existing deserialization defenses won't catch this because nothing gets instantiated or unserialized. The attack chains existing framework classes together, making `system` callable without needing any new code injection. The permission requirement (`admin.pages` or `api.pages.write`) creates a meaningful constraint: this is primarily a privilege escalation issue in single-tenant deployments, but becomes a cross-tenant compromise vector in multi-tenant setups where different users control different pages. The execution trigger is view-based rather than save-based. Malicious frontmatter sits dormant until something accesses the page, which delays detection and complicates incident reconstruction—the attack runs under whoever browses the page next, not necessarily the editor who planted the payload. Version 2.0.7 patches `system`, `exec`, and `passthru` specifically, but this targeted approach leaves gaps. The underlying issue is the API's unrestricted callable acceptance, and other PHP built-ins like `shell_exec` or `proc_open` could serve the same trampoline function. The authorization model for blueprint callbacks warrants deeper scrutiny beyond this single fix.

Reviewed through automated stages and approved by a human before publication.