Authenticated code execution via error_log file append

Code injection in Grav before 2.0.15 allows remote authenticated users to execute PHP via a crafted Blueprint dynamic-data directive. Blueprint::isSafeDynamicCall() applies a denylist to bare PHP functions instead of a positive allowlist, so error_log passes validation and call_user_func_array() appends attacker-controlled PHP to an attacker-chosen web-accessible file. Exploitation requires page-edit or blueprint-configuration access and reaches remote code execution when the written file is served or later included by the application.