# getgrav/grav (Packagist) vulnerabilities 105 known vulnerabilities (12 critical, 48 high, 38 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/getgrav/grav ## Advisories (105) ### [CVE-2026-86197](https://cve.now/CVE-2026-86197): Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox - Severity: Medium 5.1 - Published: Sep 5, 2026 - Affected: fixed in 2.0.20. ### [CVE-2026-76846](https://cve.now/CVE-2026-76846): Grav before 2.0.16 Information Disclosure via Twig Sandbox - Severity: High 8.7 - Published: Aug 25, 2026 - Affected: fixed in 2.0.16. ### [CVE-2026-76839](https://cve.now/CVE-2026-76839): Grav before 2.0.16 Information Disclosure via offsetGet - Severity: High 8.7 - Published: Aug 25, 2026 - Affected: fixed in 2.0.16. ### [CVE-2026-72702](https://cve.now/CVE-2026-72702): Grav CMS before 2.0.16 Origin Validation Bypass via Referer - Severity: Critical 9.3 - Published: Aug 25, 2026 - Affected: fixed in 2.0.16. ### [CVE-2026-72701](https://cve.now/CVE-2026-72701): Grav CMS before 2.0.16 Timing Attack via verifyNonce - Severity: Medium 6.3 - Published: Aug 25, 2026 - Affected: fixed in 2.0.16. ### [CVE-2026-72698](https://cve.now/CVE-2026-72698): Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass - Severity: High 7.1 - Published: Aug 25, 2026 - Affected: fixed in 2.0.16. ### [CVE-2026-72697](https://cve.now/CVE-2026-72697): Grav CMS before 2.0.16 Path Traversal via media\_directory - Severity: High 7.1 - Published: Aug 25, 2026 - Affected: fixed in 2.0.16. ### [CVE-2026-72695](https://cve.now/CVE-2026-72695): Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile - Severity: High 7.1 - Published: Aug 25, 2026 - Affected: fixed in 2.0.16. ### [CVE-2026-64850](https://cve.now/CVE-2026-64850): Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() - Severity: High 8.7 - Published: Aug 19, 2026 - Affected: fixed in 2.0.7. ### [CVE-2026-62673](https://cve.now/CVE-2026-62673): Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems - Severity: High 8.2 - Published: Aug 19, 2026 - Affected: fixed in 2.0.4. ### [CVE-2026-62672](https://cve.now/CVE-2026-62672): Grav: Authenticated ReDoS via regex\_replace in Twig Sandbox - Severity: Medium 6.0 - Published: Aug 19, 2026 - Affected: fixed in 2.0.4. ### [CVE-2026-62669](https://cve.now/CVE-2026-62669): Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge - Severity: High 7.4 - Published: Aug 19, 2026 - Affected: fixed in 2.0.4. ### [CVE-2026-61842](https://cve.now/CVE-2026-61842): Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) - Severity: Medium 6.5 - Published: Aug 19, 2026 - Affected: fixed in 2.0.2. ### [CVE-2026-61690](https://cve.now/CVE-2026-61690): Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits - Severity: Medium 6.5 - Published: Aug 19, 2026 - Affected: fixed in 2.0.1. ### [CVE-2026-75837](https://cve.now/CVE-2026-75837): Grav before 2.0.14 Privilege Escalation via Group Access Field - Severity: Critical 9.3 - Published: Aug 18, 2026 - Affected: fixed in 2.0.14. ### [CVE-2026-75834](https://cve.now/CVE-2026-75834): Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte - Severity: Medium 5.1 - Published: Aug 18, 2026 - Affected: fixed in 2.0.14. ### [CVE-2026-75831](https://cve.now/CVE-2026-75831): Grav before 2.0.15 Stored XSS via audio/video source URL - Severity: Medium 5.1 - Published: Aug 18, 2026 - Affected: fixed in 2.0.15. ### [CVE-2026-75828](https://cve.now/CVE-2026-75828): Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass - Severity: Critical 9.3 - Published: Aug 18, 2026 - Affected: fixed in 2.0.15. ### [CVE-2026-75827](https://cve.now/CVE-2026-75827): Grav before 2.0.15 Arbitrary File Write via error\_log - Severity: Critical 9.3 - Published: Aug 18, 2026 - Affected: fixed in 2.0.15. ### [CVE-2026-74907](https://cve.now/CVE-2026-74907): Grav before 2.0.15 Path Traversal via plugin-asset-map.php - Severity: High 8.2 - Published: Aug 18, 2026 - Affected: fixed in 2.0.15. ### [CVE-2026-72832](https://cve.now/CVE-2026-72832): Grav before 2.0.13 Stored XSS via quoted-attribute bypass - Severity: Medium 5.1 - Published: Aug 14, 2026 - Affected: from 1.5.2, fixed in 2.0.13. ### [CVE-2026-72819](https://cve.now/CVE-2026-72819): Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload - Severity: High 8.7 - Published: Aug 14, 2026 - Affected: fixed in 2.0.13. ### [CVE-2026-69089](https://cve.now/CVE-2026-69089): Grav CMS before 2.0.11 Path Traversal via watermark - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: from 2.0.10, fixed in 2.0.11. ### [CVE-2026-69088](https://cve.now/CVE-2026-69088): Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint - Severity: High 8.6 - Published: Aug 3, 2026 - Affected: from 2.0.7, fixed in 2.0.11. ### [CVE-2026-65608](https://cve.now/CVE-2026-65608): Grav before 2.0.9 Remote Code Execution via FlexDirectory - Severity: High 8.7 - Published: Jul 23, 2026 - Affected: from 1.7.0, fixed in 2.0.9. ### [CVE-2026-65008](https://cve.now/CVE-2026-65008): Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData - Severity: Critical 9.3 - Published: Jul 21, 2026 - Affected: fixed in 2.0.7. ### [CVE-2026-62237](https://cve.now/CVE-2026-62237): Grav \< 2.0.4 ReDoS via regex\_replace in Sandbox - Severity: Medium 6.0 - Published: Jul 17, 2026 - Affected: fixed in 2.0.4. ### [CVE-2026-62232](https://cve.now/CVE-2026-62232): Grav \< 2.0.4 2FA Bypass via Secret Regeneration - Severity: Critical 9.1 - Published: Jul 17, 2026 - Affected: fixed in 2.0.4. ### [CVE-2026-62230](https://cve.now/CVE-2026-62230): Grav \< 2.0.4 File Access Bypass via Case Variation - Severity: High 8.7 - Published: Jul 17, 2026 - Affected: fixed in 2.0.4. ### [CVE-2026-61453](https://cve.now/CVE-2026-61453): Grav before 2.0.1 XSS via Twig String Concatenation - Severity: Medium 5.1 - Published: Jul 15, 2026 - Affected: from 2.0.0, fixed in 2.0.1. ### [CVE-2026-61449](https://cve.now/CVE-2026-61449): Grav before 2.0.2 Decompression Bomb via Forged ZIP Size - Severity: High 7.1 - Published: Jul 15, 2026 - Affected: from 2.0.1, fixed in 2.0.2. ### [CVE-2026-59193](https://cve.now/CVE-2026-59193): Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() - Severity: Medium 6.9 - Published: Jul 10, 2026 - Affected: from 1.0.0, fixed in 2.0.0. ### [CVE-2026-55890](https://cve.now/CVE-2026-55890): Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() - Severity: Medium 4.8 - Published: Jul 10, 2026 - Affected: fixed in 2.0.0-rc.9. ### [CVE-2026-55885](https://cve.now/CVE-2026-55885): Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets - Severity: Medium 6.8 - Published: Jul 10, 2026 - Affected: fixed in 1.7.53. ### [CVE-2026-53653](https://cve.now/CVE-2026-53653): Grav: Unauthenticated denial of service via unbounded image derivative dimensions - Severity: High 8.7 - Published: Jul 10, 2026 - Affected: from 2.0.0-beta.1, fixed in 2.0.0-rc.8; fixed in 1.7.53. ### [CVE-2026-61455](https://cve.now/CVE-2026-61455): Grav before 2.0.1 Decompression Bomb via ZipArchiver - Severity: High 7.1 - Published: Jul 10, 2026 - Affected: fixed in 2.0.1. ### [CVE-2026-61450](https://cve.now/CVE-2026-61450): Grav before 2.0.2 Config Exfiltration via offsetGet Filter - Severity: High 7.1 - Published: Jul 10, 2026 - Affected: fixed in 2.0.2. ### [CVE-2026-58657](https://cve.now/CVE-2026-58657): Grav - Stored CSS Injection via Markdown Image resize() Action - Severity: Medium 4.8 - Published: Jul 8, 2026 - Affected: from 2.0.0-rc.9, fixed in 2.0.0. ### [CVE-2026-56700](https://cve.now/CVE-2026-56700): Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection - Severity: Critical 9.3 - Published: Jun 30, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2020-37256](https://cve.now/CVE-2020-37256): Grav - Cross-Site Scripting in Admin Plugin Page Editor - Severity: Medium 5.1 - Published: Jun 25, 2026 - Affected: fixed in 1.6.30. ### [CVE-2026-56701](https://cve.now/CVE-2026-56701): Grav - XML External Entity Injection via SVG Upload - Severity: High 7.1 - Published: Jun 23, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42844](https://cve.now/CVE-2026-42844): Grav: Low-privileged API users can create super-admin accounts via blueprint-upload - Severity: High 8.7 - Published: May 12, 2026 - Affected: fixed in 2.0.0-beta.4. ### [CVE-2026-44737](https://cve.now/CVE-2026-44737): grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/\[page\], parameter data\[header\]\[title\] - Severity: Medium 6.2 - Published: May 11, 2026 - Affected: fixed in 1.7.49.5. ### [CVE-2026-44738](https://cve.now/CVE-2026-44738): Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() - Severity: High 7.7 - Published: May 11, 2026 - Affected: fixed in 2.0.0-rc.2. ### [CVE-2026-42842](https://cve.now/CVE-2026-42842): grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel - Severity: Medium 5.4 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42613](https://cve.now/CVE-2026-42613): Grav: Privilege Escalation via Missing Server-Side Validation of groups/access - Severity: Critical 9.4 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42612](https://cve.now/CVE-2026-42612): Grav: Publisher-Level Stored XSS via Unquoted Event Attributes - Severity: High 8.5 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42611](https://cve.now/CVE-2026-42611): Grav: Stored XSS via Tag Injection - Severity: High 8.9 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42610](https://cve.now/CVE-2026-42610): Grav: Sensitive Information Disclosure via Accounts Service Bypass - Severity: Medium 6.5 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42609](https://cve.now/CVE-2026-42609): Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic - Severity: High 8.1 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42608](https://cve.now/CVE-2026-42608): Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. - Severity: High 8.8 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42607](https://cve.now/CVE-2026-42607): Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature - Severity: Critical 9.1 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-42841](https://cve.now/CVE-2026-42841): Grav: Stored XSS via Markdown media attribute() action in Grav CMS - Severity: Medium 6.9 - Published: May 11, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2026-7317](https://cve.now/CVE-2026-7317): Grav CMS Cache Value FileCache.php doGet deserialization - Severity: Low 2.3 - Published: Apr 28, 2026 - Affected: fixed in 2.0.0-beta.2. ### [CVE-2025-66844](https://cve.now/CVE-2025-66844): In grav \<1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig… - Severity: Critical 9.1 - Published: Dec 15, 2025 - Affected: through 1.7.49.5. ### [CVE-2025-66843](https://cve.now/CVE-2025-66843): grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. - Severity: Medium 5.4 - Published: Dec 15, 2025 - Affected: through 1.7.49.5. ### [CVE-2025-65186](https://cve.now/CVE-2025-65186): Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). - Severity: Medium 6.1 - Published: Dec 2, 2025 - Affected: through 1.7.49. ### [CVE-2025-66312](https://cve.now/CVE-2025-66312): Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/accounts/groups/\[group\]\` parameter \`data\[readableName\]\` - Severity: Medium 6.2 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66311](https://cve.now/CVE-2025-66311): Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/pages/\[page\]\` in Multiples parameters - Severity: Medium 6.2 - Published: Dec 1, 2025 - Affected: fixed in 1.11.0-beta.1. ### [CVE-2025-66310](https://cve.now/CVE-2025-66310): Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/pages/\[page\]\` parameter \`data\[header\]\[template\]\` in Advanced Tab - Severity: Medium 6.2 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66309](https://cve.now/CVE-2025-66309): Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/\[page\], parameter data\[header\]\[content\]\[items\], located in… - Severity: Medium 6.2 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66308](https://cve.now/CVE-2025-66308): Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/config/site\` parameter \`data\[taxonomies\]\` - Severity: Medium 6.8 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66307](https://cve.now/CVE-2025-66307): Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure - Severity: Medium 6.5 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66306](https://cve.now/CVE-2025-66306): Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel - Severity: Medium 4.3 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66305](https://cve.now/CVE-2025-66305): Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter - Severity: Medium 6.9 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66304](https://cve.now/CVE-2025-66304): Grav Exposes Password Hashes Leading to privilege escalation - Severity: Medium 6.2 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66303](https://cve.now/CVE-2025-66303): Grav is vulnerable to a DOS on the admin panel - Severity: Medium 4.9 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66302](https://cve.now/CVE-2025-66302): Grav vulnerable to Path Traversal allowing server files backup - Severity: Medium 6.8 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66301](https://cve.now/CVE-2025-66301): Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions - Severity: High 8.6 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66300](https://cve.now/CVE-2025-66300): Grav is vulnerable to Arbitrary File Read - Severity: High 8.5 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66299](https://cve.now/CVE-2025-66299): Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS - Severity: High 8.8 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66298](https://cve.now/CVE-2025-66298): Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms - Severity: High 7.7 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66297](https://cve.now/CVE-2025-66297): Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection - Severity: High 7.4 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66296](https://cve.now/CVE-2025-66296): Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover - Severity: High 8.8 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66294](https://cve.now/CVE-2025-66294): Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass - Severity: High 8.7 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2025-66295](https://cve.now/CVE-2025-66295): Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption - Severity: High 8.8 - Published: Dec 1, 2025 - Affected: fixed in 1.8.0-beta.27. ### [CVE-2024-35498](https://cve.now/CVE-2024-35498): A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. - Severity: Medium 6.1 - Published: Jan 6, 2025 - Affected: through 1.7.45. ### [CVE-2024-34082](https://cve.now/CVE-2024-34082): Grav Arbitrary File Read to Account Takeover - Severity: High 8.5 - Published: May 15, 2024 - Affected: fixed in 1.7.46. ### [CVE-2024-28119](https://cve.now/CVE-2024-28119): Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler - Severity: High 8.8 - Published: Mar 21, 2024 - Affected: fixed in 1.7.45. ### [CVE-2024-28118](https://cve.now/CVE-2024-28118): Grav vulnerable to Server Side Template Injection (SSTI) - Severity: High 8.8 - Published: Mar 21, 2024 - Affected: fixed in 1.7.45. ### [CVE-2024-28117](https://cve.now/CVE-2024-28117): Grav vulnerable to Server Side Template Injection (SSTI) - Severity: High 8.8 - Published: Mar 21, 2024 - Affected: fixed in 1.7.45. ### [CVE-2024-28116](https://cve.now/CVE-2024-28116): Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass - Severity: High 8.8 - Published: Mar 21, 2024 - Affected: fixed in 1.7.45. ### [CVE-2024-27921](https://cve.now/CVE-2024-27921): Grav File Upload Path Traversal vulnerability - Severity: High 8.8 - Published: Mar 21, 2024 - Affected: fixed in 1.7.45. ### [CVE-2024-27923](https://cve.now/CVE-2024-27923): Remote Code Execution by uploading a phar file using frontmatter - Severity: High 8.8 - Published: Mar 6, 2024 - Affected: fixed in 1.7.43. ### [CVE-2023-31506](https://cve.now/CVE-2023-31506): A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary… - Severity: Medium 5.4 - Published: Feb 9, 2024 - Affected: all versions. ### [CVE-2023-37897](https://cve.now/CVE-2023-37897): Server-side Template Injection (SSTI) in grav - Severity: High 7.2 - Published: Jul 18, 2023 - Affected: fixed in 1.7.42.2. ### [CVE-2023-34448](https://cve.now/CVE-2023-34448): Grav Server-side Template Injection (SSTI) via Twig Default Filters - Severity: High 8.8 - Published: Jun 14, 2023 - Affected: fixed in 1.7.42. ### [CVE-2023-34253](https://cve.now/CVE-2023-34253): Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass - Severity: High 8.8 - Published: Jun 14, 2023 - Affected: fixed in 1.7.42. ### [CVE-2023-34252](https://cve.now/CVE-2023-34252): Grav Server-side Template Injection via Insufficient Validation in filterFilter - Severity: High 8.8 - Published: Jun 14, 2023 - Affected: fixed in 1.7.42. ### [CVE-2023-34251](https://cve.now/CVE-2023-34251): Grav Server Side Template Injection vulnerability - Severity: Critical 10.0 - Published: Jun 14, 2023 - Affected: fixed in 1.7.42. ### [CVE-2022-2073](https://cve.now/CVE-2022-2073): Code Injection in getgrav/grav - Severity: Critical 9.1 - Published: Jun 29, 2022 - Affected: fixed in 1.7.34. ### [CVE-2022-1173](https://cve.now/CVE-2022-1173): stored xss in getgrav/grav - Severity: High 8.2 - Published: Apr 26, 2022 - Affected: fixed in 1.7.33. ### [CVE-2022-0970](https://cve.now/CVE-2022-0970): Cross-site Scripting (XSS) - Stored in getgrav/grav - Severity: High 7.1 - Published: Mar 15, 2022 - Affected: fixed in 1.7.31. ### [CVE-2022-0743](https://cve.now/CVE-2022-0743): Cross-site Scripting (XSS) - Stored in getgrav/grav - Severity: Medium 4.6 - Published: Feb 28, 2022 - Affected: fixed in 1.7.31. ### [CVE-2022-0268](https://cve.now/CVE-2022-0268): Cross-site Scripting (XSS) - Stored in getgrav/grav - Severity: Medium 5.7 - Published: Jan 25, 2022 - Affected: fixed in 1.7.28. ### [CVE-2021-3924](https://cve.now/CVE-2021-3924): Path Traversal in getgrav/grav - Severity: High 8.8 - Published: Nov 5, 2021 - Affected: through 1.7.24. ### [CVE-2021-3904](https://cve.now/CVE-2021-3904): Cross-site Scripting (XSS) - Stored in getgrav/grav - Severity: Medium 6.3 - Published: Oct 27, 2021 - Affected: fixed in 1.7.24. ### [CVE-2021-3818](https://cve.now/CVE-2021-3818): Reliance on Cookies without Validation and Integrity Checking in getgrav/grav - Severity: Medium 6.3 - Published: Sep 27, 2021 - Affected: fixed in 1.7.21. ### [CVE-2021-29440](https://cve.now/CVE-2021-29440): Twig allowing dangerous PHP functions by default - Severity: High 8.4 - Published: Apr 13, 2021 - Affected: fixed in 1.7.11. ### [CVE-2020-29553](https://cve.now/CVE-2020-29553): The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a… - Severity: Unrated - Published: Mar 15, 2021 - Affected: from 1.7.0-beta.1, through 1.7.0-rc.17; fixed in 1.6.30. ### [CVE-2020-29555](https://cve.now/CVE-2020-29555): The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the… - Severity: Unrated - Published: Mar 15, 2021 - Affected: from 1.7.0-beta.1, through 1.7.0-rc.17; fixed in 1.6.30. ### [CVE-2020-29556](https://cve.now/CVE-2020-29556): The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying… - Severity: Unrated - Published: Mar 15, 2021 - Affected: from 1.7.0-beta.1, through 1.7.0-rc.17; fixed in 1.6.30. ### [CVE-2020-11529](https://cve.now/CVE-2020-11529): Common/Grav.php in Grav before 1.7 has an Open Redirect. - Severity: Unrated - Published: Apr 4, 2020 - Affected: fixed in 1.6.23. ### [CVE-2019-16126](https://cve.now/CVE-2019-16126): Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images. - Severity: Unrated - Published: Sep 9, 2019 - Affected: fixed in 1.7.0-beta.8. ### [CVE-2018-5233](https://cve.now/CVE-2018-5233): Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to… - Severity: Unrated - Published: Mar 19, 2018 - Affected: fixed in 1.3.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/getgrav/grav Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.