Getgrav Grav

94 CVEs affecting Getgrav Grav. Latest disclosed: 2026-07-17. Critical: 9, High: 40.

Top CVEs affecting Getgrav Grav
CVESeverityScorePublishedSummary
CVE-2023-34251Critical9.92023-06-14Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by…
CVE-2021-47812Critical9.82026-01-16GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the sc…
CVE-2025-46199Critical9.82025-07-25Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields
CVE-2026-61451Critical9.62026-07-15The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-pas…
CVE-2025-66301Critical9.62025-12-01Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/page…
CVE-2026-42613Critical9.42026-05-11Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields…
CVE-2026-42608Critical9.12026-05-11Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sess…
CVE-2026-42607Critical9.12026-05-11Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploa…
CVE-2025-66844Critical9.12025-12-15In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration…
CVE-2026-42611High8.92026-05-11Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg ele…
CVE-2026-62233High8.82026-07-17grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write ma…
CVE-2026-61457High8.82026-07-15The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFi…
CVE-2026-58655High8.82026-07-15The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rende…
CVE-2026-42844High8.82026-05-12Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to wri…
CVE-2025-66299High8.82025-12-01Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user…
CVE-2025-66297High8.82025-12-01Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig p…
CVE-2025-66296High8.82025-12-01Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username un…
CVE-2025-66295High8.82025-12-01Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a u…
CVE-2025-66294High8.82025-12-01Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attac…
CVE-2025-46198High8.82025-07-25Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img el…