VulnSocial

CVE-2026-75827Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC and exploit tooling are both present
  • 2 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-18: 2PoC Mentioned / Linked · 2026-09-18: 1Exploit Tool / Code · 2026-09-18: 1Technical Details · 2026-09-18: 209-18
Signal classification2 categories
Disclosure
150.0%
Exploit
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • abraxas@abraxas_null
    Exploit

    #4 today. getting tired. CVE-2026-75827 - getgrav - (HIGH 8.8) - Unauthenticated GET /poc-form - Arbitrary File Write exploit: https://github.com/abraxas/CVE-2026-75827 write-up (with infra): https://abraxaslabs.tech/research/cve-2026-75827 https://t.co/r6xesI0i9p

    Post summary

    The post discloses a high-severity unauthenticated arbitrary file write vulnerability in getgrav and shares an exploit repository along with a related write-up link.

    00051167
    636 followersView on X
  • Orizon Signals@OrizonSignals
    Disclosure

    CVE-2026-75827: Grav's blueprint dynamic-data handler allows bare function calls, and its denylist omits error_log — arbitrary file write. Confirmed on core tag 2.0.13; check your version and blueprint providers now. https://github.com/advisories/GHSA-f8wv-xp27-6gq7 https://t.co/DFVQB07ix4

    Post summary

    The post discloses technical details for CVE-2026-75827 in Grav, describing a dynamic-data handler issue that can lead to arbitrary file write. It does not report active exploitation, provide a named exploit, share a PoC, or mention a specific patch or workaround.

    0000040
    1 followersView on X

Explore more

Back to dashboard