A high-severity code injection vulnerability in Grav CMS allows authenticated attackers to execute arbitrary methods, necessitating an immediate system update.

This vulnerability is categorized as CWE-94 (Improper Control of Generation of Code). It allows an authenticated user to perform arbitrary method invocation through the blueprint system, which can be leveraged to achieve code injection within the CMS environment.

The CVSS score of 8.1 indicates a high risk to the platform. An attacker with administrative or low-level access could escalate privileges or gain remote code execution, leading to full site compromise, defacement, or the theft of sensitive configuration data and user credentials stored within the CMS.

Immediate Action: Update Grav CMS to version 2.0.11 or later to remediate the vulnerability.

Proactive Monitoring: Monitor server logs and file integrity systems for unauthorized changes or the execution of unexpected system commands originating from the CMS administrative interface.

Compensating Controls: Use a Web Application Firewall (WAF) to filter suspicious requests that attempt to invoke restricted methods or modify blueprints via the administrative dashboard.

Public Exploit Available: No (exploit_available: unknown)

The presence of a proof-of-concept and the critical nature of the flaw make this an urgent security priority. Administrators should apply the 2.0.11 patch immediately to prevent the potential for unauthorized code execution and complete system takeover.