Authenticated code execution via callable-array validation bypass

Code injection in Grav before 2.0.13 allows remote authenticated users to execute arbitrary commands via a malicious ZIP upload. Flex Objects settings validation checks callable names only when supplied as strings, so an array-form Installer::unZip callable bypasses both safety lists and receives attacker-controlled arguments. A logged-in user able to save plugin settings and upload media can place PHP in the public web root and execute it as the web server account.