PackagistPackage

getgrav/grav

105 known vulnerabilities (12 critical, 48 high, 38 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 105 · 12 critical, 48 high, 38 medium, 1 low

Registry: Packagist

Advisories 105

CVE-2026-86197Medium 5.1
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
Affected: fixed in 2.0.20.
CVE-2026-76846High 8.7
Grav before 2.0.16 Information Disclosure via Twig Sandbox
Affected: fixed in 2.0.16.
CVE-2026-76839High 8.7
Grav before 2.0.16 Information Disclosure via offsetGet
Affected: fixed in 2.0.16.
CVE-2026-72702Critical 9.3
Grav CMS before 2.0.16 Origin Validation Bypass via Referer
Affected: fixed in 2.0.16.
CVE-2026-72701Medium 6.3
Grav CMS before 2.0.16 Timing Attack via verifyNonce
Affected: fixed in 2.0.16.
CVE-2026-72698High 7.1
Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Affected: fixed in 2.0.16.
CVE-2026-72697High 7.1
Grav CMS before 2.0.16 Path Traversal via media_directory
Affected: fixed in 2.0.16.
CVE-2026-72695High 7.1
Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
Affected: fixed in 2.0.16.
CVE-2026-64850High 8.7
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Affected: fixed in 2.0.7.
CVE-2026-62673High 8.2
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Affected: fixed in 2.0.4.
CVE-2026-62672Medium 6.0
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Affected: fixed in 2.0.4.
CVE-2026-62669High 7.4
Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Affected: fixed in 2.0.4.
CVE-2026-61842Medium 6.5
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Affected: fixed in 2.0.2.
CVE-2026-61690Medium 6.5
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Affected: fixed in 2.0.1.
CVE-2026-75837Critical 9.3
Grav before 2.0.14 Privilege Escalation via Group Access Field
Affected: fixed in 2.0.14.

Show all 105 advisoriesShow fewer advisories

CVE-2026-75834Medium 5.1
Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte
Affected: fixed in 2.0.14.
CVE-2026-75831Medium 5.1
Grav before 2.0.15 Stored XSS via audio/video source URL
Affected: fixed in 2.0.15.
CVE-2026-75828Critical 9.3
Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass
Affected: fixed in 2.0.15.
CVE-2026-75827Critical 9.3
Grav before 2.0.15 Arbitrary File Write via error_log
Affected: fixed in 2.0.15.
CVE-2026-74907High 8.2
Grav before 2.0.15 Path Traversal via plugin-asset-map.php
Affected: fixed in 2.0.15.
CVE-2026-72832Medium 5.1
Grav before 2.0.13 Stored XSS via quoted-attribute bypass
Affected: from 1.5.2, fixed in 2.0.13.
CVE-2026-72819High 8.7
Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Affected: fixed in 2.0.13.
CVE-2026-69089High 8.7
Grav CMS before 2.0.11 Path Traversal via watermark
Affected: from 2.0.10, fixed in 2.0.11.
CVE-2026-69088High 8.6
Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint
Affected: from 2.0.7, fixed in 2.0.11.
CVE-2026-65608High 8.7
Grav before 2.0.9 Remote Code Execution via FlexDirectory
Affected: from 1.7.0, fixed in 2.0.9.
CVE-2026-65008Critical 9.3
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
Affected: fixed in 2.0.7.
CVE-2026-62237Medium 6.0
Grav < 2.0.4 ReDoS via regex_replace in Sandbox
Affected: fixed in 2.0.4.
CVE-2026-62232Critical 9.1
Grav < 2.0.4 2FA Bypass via Secret Regeneration
Affected: fixed in 2.0.4.
CVE-2026-62230High 8.7
Grav < 2.0.4 File Access Bypass via Case Variation
Affected: fixed in 2.0.4.
CVE-2026-61453Medium 5.1
Grav before 2.0.1 XSS via Twig String Concatenation
Affected: from 2.0.0, fixed in 2.0.1.
CVE-2026-61449High 7.1
Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
Affected: from 2.0.1, fixed in 2.0.2.
CVE-2026-59193Medium 6.9
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Affected: from 1.0.0, fixed in 2.0.0.
CVE-2026-55890Medium 4.8
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()
Affected: fixed in 2.0.0-rc.9.
CVE-2026-55885Medium 6.8
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
Affected: fixed in 1.7.53.
CVE-2026-53653High 8.7
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
Affected: from 2.0.0-beta.1, fixed in 2.0.0-rc.8; fixed in 1.7.53.
CVE-2026-61455High 7.1
Grav before 2.0.1 Decompression Bomb via ZipArchiver
Affected: fixed in 2.0.1.
CVE-2026-61450High 7.1
Grav before 2.0.2 Config Exfiltration via offsetGet Filter
Affected: fixed in 2.0.2.
CVE-2026-58657Medium 4.8
Grav - Stored CSS Injection via Markdown Image resize() Action
Affected: from 2.0.0-rc.9, fixed in 2.0.0.
CVE-2026-56700Critical 9.3
Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection
Affected: fixed in 2.0.0-beta.2.
CVE-2020-37256Medium 5.1
Grav - Cross-Site Scripting in Admin Plugin Page Editor
Affected: fixed in 1.6.30.
CVE-2026-56701High 7.1
Grav - XML External Entity Injection via SVG Upload
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42844High 8.7
Grav: Low-privileged API users can create super-admin accounts via blueprint-upload
Affected: fixed in 2.0.0-beta.4.
CVE-2026-44737Medium 6.2
grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]
Affected: fixed in 1.7.49.5.
CVE-2026-44738High 7.7
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Affected: fixed in 2.0.0-rc.2.
CVE-2026-42842Medium 5.4
grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42613Critical 9.4
Grav: Privilege Escalation via Missing Server-Side Validation of groups/access
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42612High 8.5
Grav: Publisher-Level Stored XSS via Unquoted Event Attributes
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42611High 8.9
Grav: Stored XSS via Tag Injection
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42610Medium 6.5
Grav: Sensitive Information Disclosure via Accounts Service Bypass
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42609High 8.1
Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42608High 8.8
Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42607Critical 9.1
Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
Affected: fixed in 2.0.0-beta.2.
CVE-2026-42841Medium 6.9
Grav: Stored XSS via Markdown media attribute() action in Grav CMS
Affected: fixed in 2.0.0-beta.2.
CVE-2026-7317Low 2.3
Grav CMS Cache Value FileCache.php doGet deserialization
Affected: fixed in 2.0.0-beta.2.
CVE-2025-66844Critical 9.1
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig…
Affected: through 1.7.49.5.
CVE-2025-66843Medium 5.4
grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality.
Affected: through 1.7.49.5.
CVE-2025-65186Medium 6.1
Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS).
Affected: through 1.7.49.
CVE-2025-66312Medium 6.2
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66311Medium 6.2
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
Affected: fixed in 1.11.0-beta.1.
CVE-2025-66310Medium 6.2
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66309Medium 6.2
Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in…
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66308Medium 6.8
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66307Medium 6.5
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66306Medium 4.3
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66305Medium 6.9
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66304Medium 6.2
Grav Exposes Password Hashes Leading to privilege escalation
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66303Medium 4.9
Grav is vulnerable to a DOS on the admin panel
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66302Medium 6.8
Grav vulnerable to Path Traversal allowing server files backup
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66301High 8.6
Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66300High 8.5
Grav is vulnerable to Arbitrary File Read
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66299High 8.8
Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66298High 7.7
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66297High 7.4
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66296High 8.8
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66294High 8.7
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Affected: fixed in 1.8.0-beta.27.
CVE-2025-66295High 8.8
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
Affected: fixed in 1.8.0-beta.27.
CVE-2024-35498Medium 6.1
A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Affected: through 1.7.45.
CVE-2024-34082High 8.5
Grav Arbitrary File Read to Account Takeover
Affected: fixed in 1.7.46.
CVE-2024-28119High 8.8
Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler
Affected: fixed in 1.7.45.
CVE-2024-28118High 8.8
Grav vulnerable to Server Side Template Injection (SSTI)
Affected: fixed in 1.7.45.
CVE-2024-28117High 8.8
Grav vulnerable to Server Side Template Injection (SSTI)
Affected: fixed in 1.7.45.
CVE-2024-28116High 8.8
Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
Affected: fixed in 1.7.45.
CVE-2024-27921High 8.8
Grav File Upload Path Traversal vulnerability
Affected: fixed in 1.7.45.
CVE-2024-27923High 8.8
Remote Code Execution by uploading a phar file using frontmatter
Affected: fixed in 1.7.43.
CVE-2023-31506Medium 5.4
A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary…
Affected: all versions.
CVE-2023-37897High 7.2
Server-side Template Injection (SSTI) in grav
Affected: fixed in 1.7.42.2.
CVE-2023-34448High 8.8
Grav Server-side Template Injection (SSTI) via Twig Default Filters
Affected: fixed in 1.7.42.
CVE-2023-34253High 8.8
Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass
Affected: fixed in 1.7.42.
CVE-2023-34252High 8.8
Grav Server-side Template Injection via Insufficient Validation in filterFilter
Affected: fixed in 1.7.42.
CVE-2023-34251Critical 10.0
Grav Server Side Template Injection vulnerability
Affected: fixed in 1.7.42.
CVE-2022-2073Critical 9.1
Code Injection in getgrav/grav
Affected: fixed in 1.7.34.
CVE-2022-1173High 8.2
stored xss in getgrav/grav
Affected: fixed in 1.7.33.
CVE-2022-0970High 7.1
Cross-site Scripting (XSS) - Stored in getgrav/grav
Affected: fixed in 1.7.31.
CVE-2022-0743Medium 4.6
Cross-site Scripting (XSS) - Stored in getgrav/grav
Affected: fixed in 1.7.31.
CVE-2022-0268Medium 5.7
Cross-site Scripting (XSS) - Stored in getgrav/grav
Affected: fixed in 1.7.28.
CVE-2021-3924High 8.8
Path Traversal in getgrav/grav
Affected: through 1.7.24.
CVE-2021-3904Medium 6.3
Cross-site Scripting (XSS) - Stored in getgrav/grav
Affected: fixed in 1.7.24.
CVE-2021-3818Medium 6.3
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
Affected: fixed in 1.7.21.
CVE-2021-29440High 8.4
Twig allowing dangerous PHP functions by default
Affected: fixed in 1.7.11.
CVE-2020-29553Unrated
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a…
Affected: from 1.7.0-beta.1, through 1.7.0-rc.17; fixed in 1.6.30.
CVE-2020-29555Unrated
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the…
Affected: from 1.7.0-beta.1, through 1.7.0-rc.17; fixed in 1.6.30.
CVE-2020-29556Unrated
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying…
Affected: from 1.7.0-beta.1, through 1.7.0-rc.17; fixed in 1.6.30.
CVE-2020-11529Unrated
Common/Grav.php in Grav before 1.7 has an Open Redirect.
Affected: fixed in 1.6.23.
CVE-2019-16126Unrated
Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
Affected: fixed in 1.7.0-beta.8.
CVE-2018-5233Unrated
Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to…
Affected: fixed in 1.3.0.