Getgrav Grav
159 CVEs affecting Getgrav Grav. Latest disclosed: 2026-08-26. Critical: 14, High: 72.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34251 | Critical | 9.9 | 2023-06-14 | Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by… |
CVE-2026-80203 | Critical | 9.8 | 2026-08-26 | The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sen… |
CVE-2026-56710 | Critical | 9.8 | 2026-08-25 | Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with a… |
CVE-2026-65008 | Critical | 9.8 | 2026-07-21 | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passe… |
CVE-2021-47812 | Critical | 9.8 | 2026-01-16 | GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the sc… |
CVE-2025-46199 | Critical | 9.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields |
CVE-2026-65007 | Critical | 9.6 | 2026-07-21 | The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiK… |
CVE-2026-61451 | Critical | 9.6 | 2026-07-15 | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-pas… |
CVE-2025-66301 | Critical | 9.6 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/page… |
CVE-2026-42613 | Critical | 9.4 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields… |
CVE-2026-75837 | Critical | 9.1 | 2026-08-18 | Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users op… |
CVE-2026-42608 | Critical | 9.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sess… |
CVE-2026-42607 | Critical | 9.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploa… |
CVE-2025-66844 | Critical | 9.1 | 2025-12-15 | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration… |
CVE-2026-42611 | High | 8.9 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg ele… |
CVE-2026-75574 | High | 8.8 | 2026-08-25 | The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authent… |
CVE-2026-75836 | High | 8.8 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarCont… |
CVE-2026-75827 | High | 8.8 | 2026-08-18 | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist inste… |
CVE-2026-72833 | High | 8.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-… |
CVE-2026-72831 | High | 8.8 | 2026-08-14 | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController… |