A critical remote code execution vulnerability in the Grav CMS allows authenticated attackers to manipulate system classes, necessitating an immediate update to version 2.0.9.

The vulnerability is categorized as CWE-470, involving unsafe reflection where externally controlled input is used to select classes or code. The attacker must possess authenticated access to the application to trigger this flaw.

With a CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the Grav CMS instance. Exploitation could allow an attacker to gain full administrative control over the web server, leading to site defacement, data exfiltration, or the deployment of malicious payloads.

Immediate Action: Upgrade the Grav CMS installation to version 2.0.9 or higher to apply the necessary security fixes.

Proactive Monitoring: Monitor server logs for unusual HTTP requests targeting the FlexDirectory component or suspicious file modifications.

Compensating Controls: If immediate patching is not feasible, implement strict input validation at the Web Application Firewall (WAF) level to block requests attempting to exploit reflection-based vulnerabilities.

Public Exploit Available: No (exploit_available: unknown)

Given the availability of a proof-of-concept and the high severity of the vulnerability, organizations should treat this as a high-priority task. Updating to version 2.0.9 is the only definitive way to eliminate the underlying security flaw.