Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Bluepr…

Grav CMS versions 2.0.7 through 2.0.10 contain a security flaw in the Blueprint::isSafeDynamicCall() function that fails to validate fully-qualified static method calls (Class::method syntax) in blueprint dynamic-field directives. The denylist for dangerous callables is only applied to strings that do not contain '::', allowing bypass via fully-qualified static method notation. An authenticated attacker with only page-editing privileges (admin.pages) can embed malicious directives in page form-field frontmatter to invoke arbitrary public static PHP methods with attacker-controlled arguments. This can be exploited to read any server-readable file, which is then disclosed to anonymous visitors of the crafted page. Additionally, the vulnerability enables arbitrary creation and copying of files and directories under the web-server account. The issue has been fixed in Grav CMS version 2.0.11.