Getgrav
Page 2 of 3 — Getgrav CVEs from a corpus of 205, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62236 | Medium | 5.4 | 2026-07-17 | grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates an… |
CVE-2026-62235 | Medium | 6.3 | 2026-07-17 | Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api… |
CVE-2026-62234 | High | 8.1 | 2026-07-17 | Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with… |
CVE-2026-62233 | High | 8.8 | 2026-07-17 | grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write ma… |
CVE-2026-62232 | High | 7.4 | 2026-07-17 | Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence… |
CVE-2026-62231 | High | 8.1 | 2026-07-17 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the Ap… |
CVE-2026-62230 | High | 7.5 | 2026-07-17 | Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .j… |
CVE-2026-61873 | High | 8.1 | 2026-07-15 | Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversa… |
CVE-2026-61457 | High | 8.8 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFi… |
CVE-2026-61453 | Medium | 6.1 | 2026-07-15 | Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before… |
CVE-2026-61452 | Medium | 5.3 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a… |
CVE-2026-61451 | Critical | 9.6 | 2026-07-15 | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-pas… |
CVE-2026-61449 | Medium | 6.5 | 2026-07-15 | Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declar… |
CVE-2026-58655 | High | 8.8 | 2026-07-15 | The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rende… |
CVE-2026-61454 | Medium | 5.3 | 2026-07-11 | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at… |
CVE-2026-59193 | Medium | 4.9 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archi… |
CVE-2026-59190 | | 2026-07-10 | grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacke… | |
CVE-2026-58493 | | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable Y… | |
CVE-2026-58492 | | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL q… | |
CVE-2026-55890 | Medium | 4.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leave… |
CVE-2026-55885 | Medium | 6.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav… |
CVE-2026-53653 | | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image… | |
CVE-2026-61456 | Medium | 4.6 | 2026-07-10 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUpload… |
CVE-2026-61455 | Medium | 6.5 | 2026-07-10 | Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth… |
CVE-2026-61450 | Medium | 6.5 | 2026-07-10 | Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configur… |
CVE-2026-58656 | High | 7.5 | 2026-07-08 | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthent… |
CVE-2020-37256 | Medium | 5.4 | 2026-06-25 | Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page edi… |
CVE-2026-42844 | High | 8.8 | 2026-05-12 | Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to wri… |
CVE-2026-44738 | High | 7.7 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from wi… |
CVE-2026-44737 | | 2026-05-11 | grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. P… | |
CVE-2026-42845 | | 2026-05-11 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4… | |
CVE-2026-42843 | High | 8.8 | 2026-05-11 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Pr… |
CVE-2026-42842 | Medium | 5.4 | 2026-05-11 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS For… |
CVE-2026-42841 | Medium | 4.8 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler… |
CVE-2026-42613 | Critical | 9.4 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields… |
CVE-2026-42612 | High | 8.5 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to… |
CVE-2026-42611 | High | 8.9 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg ele… |
CVE-2026-42610 | Medium | 6.5 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing… |
CVE-2026-42609 | High | 8.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user c… |
CVE-2026-42608 | Critical | 9.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sess… |
CVE-2026-42607 | Critical | 9.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploa… |
CVE-2026-29924 | High | 7.6 | 2026-03-30 | Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin. |
CVE-2020-36955 | Medium | 6.4 | 2026-01-26 | Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scrip… |
CVE-2021-47812 | Critical | 9.8 | 2026-01-16 | GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the sc… |
CVE-2025-66844 | Critical | 9.1 | 2025-12-15 | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration… |
CVE-2025-66843 | Medium | 5.4 | 2025-12-15 | grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with… |
CVE-2025-65186 | Medium | 6.1 | 2025-12-02 | Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor… |
CVE-2025-66312 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66311 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66310 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66309 | Medium | 6.1 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66308 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66307 | Medium | 6.5 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66306 | Medium | 4.3 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which… |
CVE-2025-66305 | Medium | 4.9 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin… |
CVE-2025-66304 | Medium | 6.2 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the passwo… |
CVE-2025-66303 | Medium | 4.9 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of sched… |
CVE-2025-66302 | Medium | 6.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers wit… |
CVE-2025-66301 | Critical | 9.6 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/page… |
CVE-2025-66300 | High | 8.5 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatte… |
CVE-2025-66299 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user… |
CVE-2025-66298 | High | 7.5 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin confi… |
CVE-2025-66297 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig p… |
CVE-2025-66296 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username un… |
CVE-2025-66295 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a u… |
CVE-2025-66294 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attac… |
CVE-2025-63593 | Medium | 6.1 | 2025-11-03 | Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). |
CVE-2025-50286 | High | 8.1 | 2025-08-06 | A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install… |
CVE-2025-46198 | High | 8.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img el… |
CVE-2025-46199 | Critical | 9.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields |
CVE-2024-35498 | Medium | 6.1 | 2025-01-06 | A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-34082 | High | 8.5 | 2024-05-15 | Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax… |
CVE-2024-28119 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context… |
CVE-2024-28118 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context… |
CVE-2024-28117 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunctio… |
CVE-2024-28116 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which a… |
CVE-2024-27921 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version… |
CVE-2024-27923 | High | 8.8 | 2024-03-21 | Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission… |
CVE-2023-31506 | Medium | 5.4 | 2024-02-09 | A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML v… |
CVE-2023-49146 | Medium | 6.1 | 2023-11-22 | DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions. |
CVE-2023-37897 | High | 7.2 | 2023-07-18 | Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerabilit… |
CVE-2023-34452 | Medium | 5.4 | 2023-06-14 | Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerabilit… |
CVE-2023-34448 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav lev… |
CVE-2023-34253 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being exec… |
CVE-2023-34252 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation… |
CVE-2023-34251 | Critical | 9.9 | 2023-06-14 | Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by… |
CVE-2022-2073 | High | 7.2 | 2022-06-29 | Code Injection in GitHub repository getgrav/grav prior to 1.7.34. |
CVE-2022-1173 | Medium | 5.4 | 2022-04-26 | stored xss in GitHub repository getgrav/grav prior to 1.7.33. |
CVE-2022-0970 | Medium | 5.4 | 2022-03-15 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. |
CVE-2022-0743 | Medium | 4.6 | 2022-02-28 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. |
CVE-2022-0268 | Medium | 5.4 | 2022-01-25 | Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28. |
CVE-2021-3920 | Medium | 5.4 | 2021-11-19 | grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3924 | High | 7.5 | 2021-11-05 | grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-3904 | Medium | 5.4 | 2021-10-27 | grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3818 | Medium | 5.3 | 2021-09-27 | grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking |
CVE-2021-3799 | Medium | 5.4 | 2021-09-27 | grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames |
CVE-2021-29440 | High | 8.4 | 2021-04-13 | Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit page… |
CVE-2021-29439 | High | 7.2 | 2021-04-13 | The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can ins… |
CVE-2021-21425 | Critical | 9.3 | 2021-04-07 | Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticat… |
CVE-2020-29553 | High | 8.8 | 2021-03-15 | The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF). |