grav

v2.0.9 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 17d Documentation

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

cms content content-management doctrine flat-file grav

+9 more

markdown php php7 symfony twig website website-builder website-generation yaml

Affected surfaces

rce_ssrf auth

ReleasePort's take

Moderate signal

editorial:auto 11d

ReleasePort Layer 1 version 2.0.9 closes a remote‑code‑execution risk in Flex blueprint fields and stops anonymous scheduled job execution when no webhook token is set.

Why it matters: Fixes prevent RCE (severity 95) and block unauthorized scheduled jobs (severity 90); operators must upgrade to mitigate these high‑severity threats.

Summary

AI summary

Two security fixes close remote code execution and unauthorized scheduled job triggers.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevents callable directives in Flex blueprint fields from executing server commands. Prevents callable directives in Flex blueprint fields from executing server commands. Source: llm_adapter@2026-07-16 Confidence: high	—
Security	Critical	Scheduler webhook trigger now fails closed when no token is configured, blocking anonymous scheduled job execution. Scheduler webhook trigger now fails closed when no token is configured, blocking anonymous scheduled job execution. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Images and links with filenames containing spaces now render correctly when wrapped in angle brackets. Images and links with filenames containing spaces now render correctly when wrapped in angle brackets. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

Bugfix

[security] A callable directive hidden in a Flex directory's blueprint field can no longer run commands on the server; dynamic field data on Flex types (Flex Pages, Flex Users, Flex Objects) now refuses dangerous functions, closing a path that bypassed the same guard added for page forms in 2.0.7 (GHSA-c4wf-2xxc-68qm).
[security] The scheduler webhook trigger now fails closed when no token is configured, so an enabled webhook left without a token can no longer run scheduled jobs for anonymous callers (GHSA-xwv3-2mv2-w33x).
Images and links whose filename contains spaces now render when the path is wrapped in angle brackets, for example ![](<My image.jpg>). Fixes getgrav/grav#4197.

Security Fixes

GHSA-c4wf-2xxc-68qm — Prevents callable directives in Flex blueprint fields from executing server commands, closing an RCE path.
GHSA-xwv3-2mv2-w33x — Scheduler webhook now fails closed when no token is configured, preventing anonymous scheduled job execution.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track grav

Get notified when new releases ship.

About grav

Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony

All releases →