# cve.now: Getgrav

The newest entries naming Getgrav as an affected vendor (up to 200), of 212 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124434](https://cve.now/CVE-2026-124434.md): Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions (CVSS 7.1)
- [CVE-2026-117604](https://cve.now/CVE-2026-117604.md): Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback (CVSS 8.7)
- [CVE-2026-116019](https://cve.now/CVE-2026-116019.md): Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives (CVSS 8.7)
- [CVE-2026-114660](https://cve.now/CVE-2026-114660.md): Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives (CVSS 7.0)
- [CVE-2026-114659](https://cve.now/CVE-2026-114659.md): Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes (CVSS 7.1)
- [CVE-2026-114658](https://cve.now/CVE-2026-114658.md): Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite (CVSS 8.7)
- [CVE-2026-114657](https://cve.now/CVE-2026-114657.md): Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri (CVSS 6.9)
- [CVE-2026-112782](https://cve.now/CVE-2026-112782.md): Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service (CVSS 8.7)
- [CVE-2026-112781](https://cve.now/CVE-2026-112781.md): Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-\*@ Directives (CVSS 8.7)
- [CVE-2026-112780](https://cve.now/CVE-2026-112780.md): Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ (CVSS 9.3)
- [CVE-2026-112779](https://cve.now/CVE-2026-112779.md): Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass (CVSS 9.3)
- [CVE-2026-109326](https://cve.now/CVE-2026-109326.md): Grav before 2.1.7 Information Disclosure via Nested .git Directories (CVSS 8.7)
- [CVE-2026-109325](https://cve.now/CVE-2026-109325.md): Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy (CVSS 8.7)
- [CVE-2026-109324](https://cve.now/CVE-2026-109324.md): Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms (CVSS 7.1)
- [CVE-2026-109323](https://cve.now/CVE-2026-109323.md): Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote\_access Authorization (CVSS 6.9)
- [CVE-2026-109322](https://cve.now/CVE-2026-109322.md): Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views (CVSS 5.3)
- [CVE-2026-109321](https://cve.now/CVE-2026-109321.md): Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass (CVSS 9.3)
- [CVE-2026-109320](https://cve.now/CVE-2026-109320.md): Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass (CVSS 5.3)
- [CVE-2026-109319](https://cve.now/CVE-2026-109319.md): Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation (CVSS 5.3)
- [CVE-2026-109317](https://cve.now/CVE-2026-109317.md): Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants (CVSS 8.6)
- [CVE-2026-109316](https://cve.now/CVE-2026-109316.md): Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin (CVSS 6.9)
- [CVE-2026-109315](https://cve.now/CVE-2026-109315.md): Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox (CVSS 7.1)
- [CVE-2026-109314](https://cve.now/CVE-2026-109314.md): Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page (CVSS 8.5)
- [CVE-2026-109313](https://cve.now/CVE-2026-109313.md): Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie (CVSS 8.6)
- [CVE-2026-109312](https://cve.now/CVE-2026-109312.md): Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form (CVSS 8.6)
- [CVE-2026-100673](https://cve.now/CVE-2026-100673.md): Grav Data Manager before 1.4.5 Stored XSS via item-detail view (CVSS 8.4)
- [CVE-2026-100672](https://cve.now/CVE-2026-100672.md): grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure (CVSS 8.7)
- [CVE-2026-100671](https://cve.now/CVE-2026-100671.md): Grav before 2.0.25 Session Cookie Theft via Twig Sandbox (CVSS 8.6)
- [CVE-2026-100670](https://cve.now/CVE-2026-100670.md): Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass (CVSS 8.7)
- [CVE-2026-100669](https://cve.now/CVE-2026-100669.md): Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass (CVSS 8.7)
- [CVE-2026-100668](https://cve.now/CVE-2026-100668.md): Grav before 2.0.25 Sandbox Escape via array Filter (CVSS 7.1)
- [CVE-2026-100667](https://cve.now/CVE-2026-100667.md): grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass (CVSS 6.9)
- [CVE-2026-92917](https://cve.now/CVE-2026-92917.md): Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print\_r (CVSS 8.7)
- [CVE-2026-92916](https://cve.now/CVE-2026-92916.md): Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork (CVSS 8.7)
- [CVE-2025-64059](https://cve.now/CVE-2025-64059.md): Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. (CVSS 1.8)
- [CVE-2026-86197](https://cve.now/CVE-2026-86197.md): Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox (CVSS 5.1)
- [CVE-2026-86196](https://cve.now/CVE-2026-86196.md): Grav API Plugin before 1.0.20 Authentication Bypass via Host Header (CVSS 8.7)
- [CVE-2026-86195](https://cve.now/CVE-2026-86195.md): grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag (CVSS 8.7)
- [CVE-2026-86194](https://cve.now/CVE-2026-86194.md): Grav Form Plugin before 9.1.22 Cross-Page Form Execution (CVSS 6.9)
- [CVE-2026-86193](https://cve.now/CVE-2026-86193.md): Grav API Plugin Authentication Bypass via Group-Inherited Super (CVSS 8.7)
- [CVE-2026-85604](https://cve.now/CVE-2026-85604.md): Grav before 2.0.18 Remote Code Execution via sort filter (CVSS 8.7)
- [CVE-2026-85603](https://cve.now/CVE-2026-85603.md): Grav Admin Plugin Path Traversal via Save As Language Code (CVSS 7.1)
- [CVE-2026-85602](https://cve.now/CVE-2026-85602.md): Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass (CVSS 9.3)
- [CVE-2026-85601](https://cve.now/CVE-2026-85601.md): Grav Admin before 2.0.20 Cross-Site Scripting via marked.js (CVSS 5.1)
- [CVE-2026-85600](https://cve.now/CVE-2026-85600.md): Grav Admin before 2.0.21 Stored XSS via username (CVSS 5.1)
- [CVE-2026-85599](https://cve.now/CVE-2026-85599.md): Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters (CVSS 5.1)
- [CVE-2026-85598](https://cve.now/CVE-2026-85598.md): Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages (CVSS 5.1)
- [CVE-2026-80204](https://cve.now/CVE-2026-80204.md): Grav before 1.0.18 Authentication Bypass via Scoped API Key (CVSS 9.3)
- [CVE-2026-80203](https://cve.now/CVE-2026-80203.md): Grav before 1.0.18 Authentication Bypass via Scoped API Key (CVSS 9.3)
- [CVE-2026-76846](https://cve.now/CVE-2026-76846.md): Grav before 2.0.16 Information Disclosure via Twig Sandbox (CVSS 8.7)
- [CVE-2026-76839](https://cve.now/CVE-2026-76839.md): Grav before 2.0.16 Information Disclosure via offsetGet (CVSS 8.7)
- [CVE-2026-75574](https://cve.now/CVE-2026-75574.md): Grav before 4.2.2 Remote Code Execution via Email Twig (CVSS 8.7)
- [CVE-2026-72702](https://cve.now/CVE-2026-72702.md): Grav CMS before 2.0.16 Origin Validation Bypass via Referer (CVSS 9.3)
- [CVE-2026-72701](https://cve.now/CVE-2026-72701.md): Grav CMS before 2.0.16 Timing Attack via verifyNonce (CVSS 6.3)
- [CVE-2026-72700](https://cve.now/CVE-2026-72700.md): Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison (CVSS 8.7)
- [CVE-2026-72699](https://cve.now/CVE-2026-72699.md): Grav Login Plugin before 3.9.1 Email Enumeration via Registration (CVSS 9.3)
- [CVE-2026-72698](https://cve.now/CVE-2026-72698.md): Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass (CVSS 7.1)
- [CVE-2026-72697](https://cve.now/CVE-2026-72697.md): Grav CMS before 2.0.16 Path Traversal via media\_directory (CVSS 7.1)
- [CVE-2026-72696](https://cve.now/CVE-2026-72696.md): Grav CMS before 2.0.16 Symlink Following via createLockFile (CVSS 8.6)
- [CVE-2026-72695](https://cve.now/CVE-2026-72695.md): Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile (CVSS 7.1)
- [CVE-2026-56710](https://cve.now/CVE-2026-56710.md): Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock (CVSS 9.3)
- [CVE-2026-56709](https://cve.now/CVE-2026-56709.md): Grav before 3.9.2 Host Header Injection via sendInvitationEmail (CVSS 8.7)
- [CVE-2026-56708](https://cve.now/CVE-2026-56708.md): Grav API Plugin before 1.0.16 SSRF via DNS Rebinding (CVSS 6.9)
- [CVE-2026-56707](https://cve.now/CVE-2026-56707.md): Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode (CVSS 8.3)
- [CVE-2026-64852](https://cve.now/CVE-2026-64852.md): Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account (CVSS 8.7)
- [CVE-2026-64850](https://cve.now/CVE-2026-64850.md): Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() (CVSS 8.7)
- [CVE-2026-64851](https://cve.now/CVE-2026-64851.md): Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers (CVSS 8.5)
- [CVE-2026-63408](https://cve.now/CVE-2026-63408.md): Grav API Plugin: JWT Access Token Accepted via \`?token=\` URL Query Parameter (CVSS 7.5)
- [CVE-2026-63407](https://cve.now/CVE-2026-63407.md): Grav API Plugin: CORS 'Access-Control-Allow-Origin: \*' on Authenticated API Responses (CVSS 8.2)
- [CVE-2026-62671](https://cve.now/CVE-2026-62671.md): CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret) (CVSS 5.4)
- [CVE-2026-62673](https://cve.now/CVE-2026-62673.md): Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems (CVSS 8.2)
- [CVE-2026-62672](https://cve.now/CVE-2026-62672.md): Grav: Authenticated ReDoS via regex\_replace in Twig Sandbox (CVSS 6.0)
- [CVE-2026-62667](https://cve.now/CVE-2026-62667.md): Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL (CVSS 8.1)
- [CVE-2026-62669](https://cve.now/CVE-2026-62669.md): Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge (CVSS 7.4)
- [CVE-2026-62666](https://cve.now/CVE-2026-62666.md): Grav API Plugin: non-super api.users.write manager -\> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super (CVSS 8.8)
- [CVE-2026-62668](https://cve.now/CVE-2026-62668.md): Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols (CVSS 9.4)
- [CVE-2026-62670](https://cve.now/CVE-2026-62670.md): Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny) (CVSS 6.3)
- [CVE-2026-61842](https://cve.now/CVE-2026-61842.md): Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) (CVSS 6.5)
- [CVE-2026-61690](https://cve.now/CVE-2026-61690.md): Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits (CVSS 6.5)
- [CVE-2026-61607](https://cve.now/CVE-2026-61607.md): Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer (CVSS 4.6)
- [CVE-2026-53654](https://cve.now/CVE-2026-53654.md): Grav: Unauthenticated open redirect via login twofa\_cancel \_redirect (CVSS 5.3)
- [CVE-2026-75837](https://cve.now/CVE-2026-75837.md): Grav before 2.0.14 Privilege Escalation via Group Access Field (CVSS 9.3)
- [CVE-2026-75836](https://cve.now/CVE-2026-75836.md): Grav API Plugin before 1.0.14 Missing Authorization (CVSS 8.7)
- [CVE-2026-75835](https://cve.now/CVE-2026-75835.md): Grav API Plugin before 1.0.14 Missing Authorization (CVSS 9.3)
- [CVE-2026-75834](https://cve.now/CVE-2026-75834.md): Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte (CVSS 5.1)
- [CVE-2026-75833](https://cve.now/CVE-2026-75833.md): Grav API Plugin Open Redirect via Backslash Bypass (CVSS 8.6)
- [CVE-2026-75832](https://cve.now/CVE-2026-75832.md): Grav API Plugin before 1.0.14 Authorization Bypass (CVSS 9.3)
- [CVE-2026-75831](https://cve.now/CVE-2026-75831.md): Grav before 2.0.15 Stored XSS via audio/video source URL (CVSS 5.1)
- [CVE-2026-75830](https://cve.now/CVE-2026-75830.md): grav-plugin-api before 1.0.15 Path Traversal via batchCopy (CVSS 7.1)
- [CVE-2026-75829](https://cve.now/CVE-2026-75829.md): grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint (CVSS 8.6)
- [CVE-2026-75828](https://cve.now/CVE-2026-75828.md): Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass (CVSS 9.3)
- [CVE-2026-75827](https://cve.now/CVE-2026-75827.md): Grav before 2.0.15 Arbitrary File Write via error\_log (CVSS 9.3)
- [CVE-2026-75107](https://cve.now/CVE-2026-75107.md): Grav Form Plugin before 9.1.19 Stored XSS via Field Properties (CVSS 5.1)
- [CVE-2026-74908](https://cve.now/CVE-2026-74908.md): Grav plugin-api before 1.0.15 Script Injection via SVG (CVSS 5.1)
- [CVE-2026-74907](https://cve.now/CVE-2026-74907.md): Grav before 2.0.15 Path Traversal via plugin-asset-map.php (CVSS 8.2)
- [CVE-2026-72833](https://cve.now/CVE-2026-72833.md): Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys (CVSS 8.7)
- [CVE-2026-72832](https://cve.now/CVE-2026-72832.md): Grav before 2.0.13 Stored XSS via quoted-attribute bypass (CVSS 5.1)
- [CVE-2026-72831](https://cve.now/CVE-2026-72831.md): Grav through 2.0.11 Authentication Bypass via Flex Objects (CVSS 8.7)
- [CVE-2026-72830](https://cve.now/CVE-2026-72830.md): Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass (CVSS 8.7)
- [CVE-2026-72829](https://cve.now/CVE-2026-72829.md): Grav before 1.0.13 API Key Scope Bypass via UsersController (CVSS 8.7)
- [CVE-2026-72828](https://cve.now/CVE-2026-72828.md): Grav before 1.0.13 API Key Scope Bypass via InvitationsController (CVSS 8.6)
- [CVE-2026-72827](https://cve.now/CVE-2026-72827.md): Grav CMS before 2.0.13 Remote Code Execution via Twig (CVSS 8.7)
- [CVE-2026-72826](https://cve.now/CVE-2026-72826.md): Grav API Plugin before 1.0.13 Scope Bypass via createApiKey (CVSS 8.7)
- [CVE-2026-72825](https://cve.now/CVE-2026-72825.md): Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController (CVSS 7.2)
- [CVE-2026-72824](https://cve.now/CVE-2026-72824.md): Grav before 1.0.13 API Key Scope Bypass via PagesController (CVSS 8.7)
- [CVE-2026-72823](https://cve.now/CVE-2026-72823.md): Grav before 1.0.13 API-key scope cap bypass via DemoController (CVSS 5.3)
- [CVE-2026-72822](https://cve.now/CVE-2026-72822.md): Grav before 1.0.13 Authentication Bypass via disable2fa (CVSS 8.7)
- [CVE-2026-72821](https://cve.now/CVE-2026-72821.md): Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle (CVSS 5.1)
- [CVE-2026-72820](https://cve.now/CVE-2026-72820.md): Grav 2.0.11 Path Traversal via Backup Profile Configuration (CVSS 6.9)
- [CVE-2026-72819](https://cve.now/CVE-2026-72819.md): Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload (CVSS 8.7)
- [CVE-2026-69089](https://cve.now/CVE-2026-69089.md): Grav CMS before 2.0.11 Path Traversal via watermark (CVSS 8.7)
- [CVE-2026-69088](https://cve.now/CVE-2026-69088.md): Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint (CVSS 8.6)
- [CVE-2026-69087](https://cve.now/CVE-2026-69087.md): Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig (CVSS 7.1)
- [CVE-2026-66400](https://cve.now/CVE-2026-66400.md): Grav Login Plugin before 3.8.13 Insufficient Session Expiration (CVSS 6.3)
- [CVE-2026-65897](https://cve.now/CVE-2026-65897.md): Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups (CVSS 8.7)
- [CVE-2026-65896](https://cve.now/CVE-2026-65896.md): Grav API Plugin before 1.0.10 Path Traversal via move (CVSS 7.1)
- [CVE-2026-65895](https://cve.now/CVE-2026-65895.md): Grav API Plugin before 1.0.10 Broken Access Control (CVSS 8.2)
- [CVE-2026-65608](https://cve.now/CVE-2026-65608.md): Grav before 2.0.9 Remote Code Execution via FlexDirectory (CVSS 8.7)
- [CVE-2026-65603](https://cve.now/CVE-2026-65603.md): Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update (CVSS 8.7)
- [CVE-2026-65008](https://cve.now/CVE-2026-65008.md): Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData (CVSS 9.3)
- [CVE-2026-65007](https://cve.now/CVE-2026-65007.md): Grav before 1.0.8 Missing Authorization on API Key Generation (CVSS 8.7)
- [CVE-2026-64628](https://cve.now/CVE-2026-64628.md): Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers (CVSS 5.1)
- [CVE-2026-62387](https://cve.now/CVE-2026-62387.md): Grav \< 1.0.0-rc.16 CORS Misconfiguration via API Plugin (CVSS 7.1)
- [CVE-2026-62386](https://cve.now/CVE-2026-62386.md): Grav \< 1.0.0-rc.16 Authentication Bypass via token URL Parameter (CVSS 8.2)
- [CVE-2026-62237](https://cve.now/CVE-2026-62237.md): Grav \< 2.0.4 ReDoS via regex\_replace in Sandbox (CVSS 6.0)
- [CVE-2026-62236](https://cve.now/CVE-2026-62236.md): grav-plugin-login \< 3.8.11 CSRF via regenerate2FASecret (CVSS 2.3)
- [CVE-2026-62235](https://cve.now/CVE-2026-62235.md): Grav Flex-Objects \< 1.4.3 Authorization Bypass via API (CVSS 2.3)
- [CVE-2026-62234](https://cve.now/CVE-2026-62234.md): Grav \< 2.0.4 SSRF via Unrestricted cURL Protocols (CVSS 8.4)
- [CVE-2026-62233](https://cve.now/CVE-2026-62233.md): grav-plugin-api \< 1.0.6 Privilege Escalation via createApiKey (CVSS 8.7)
- [CVE-2026-62232](https://cve.now/CVE-2026-62232.md): Grav \< 2.0.4 2FA Bypass via Secret Regeneration (CVSS 9.1)
- [CVE-2026-62231](https://cve.now/CVE-2026-62231.md): Grav \< 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator (CVSS 8.6)
- [CVE-2026-62230](https://cve.now/CVE-2026-62230.md): Grav \< 2.0.4 File Access Bypass via Case Variation (CVSS 8.7)
- [CVE-2026-61873](https://cve.now/CVE-2026-61873.md): Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename (CVSS 7.2)
- [CVE-2026-61457](https://cve.now/CVE-2026-61457.md): Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass (CVSS 5.3)
- [CVE-2026-61453](https://cve.now/CVE-2026-61453.md): Grav before 2.0.1 XSS via Twig String Concatenation (CVSS 5.1)
- [CVE-2026-61452](https://cve.now/CVE-2026-61452.md): Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens (CVSS 6.9)
- [CVE-2026-61451](https://cve.now/CVE-2026-61451.md): Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin\_base\_url (CVSS 9.4)
- [CVE-2026-61449](https://cve.now/CVE-2026-61449.md): Grav before 2.0.2 Decompression Bomb via Forged ZIP Size (CVSS 7.1)
- [CVE-2026-58655](https://cve.now/CVE-2026-58655.md): Grav Flex Objects - Server-Side Template Injection via Dynamic Titles (CVSS 8.7)
- [CVE-2026-61454](https://cve.now/CVE-2026-61454.md): Grav before 2.0.4 Information Disclosure via \_\_GRAV\_CONFIG\_\_ (CVSS 8.7)
- [CVE-2026-59193](https://cve.now/CVE-2026-59193.md): Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() (CVSS 6.9)
- [CVE-2026-59190](https://cve.now/CVE-2026-59190.md): Grav Admin Plugin — IDOR Privilege Escalation via saveUser() (CVSS 8.7)
- [CVE-2026-58493](https://cve.now/CVE-2026-58493.md): grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction (CVSS 5.1)
- [CVE-2026-58492](https://cve.now/CVE-2026-58492.md): grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation (CVSS 9.2)
- [CVE-2026-55890](https://cve.now/CVE-2026-55890.md): Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() (CVSS 4.8)
- [CVE-2026-55885](https://cve.now/CVE-2026-55885.md): Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets (CVSS 6.8)
- [CVE-2026-53653](https://cve.now/CVE-2026-53653.md): Grav: Unauthenticated denial of service via unbounded image derivative dimensions (CVSS 8.7)
- [CVE-2026-61456](https://cve.now/CVE-2026-61456.md): Grav before 1.0.3 Stored XSS via SVG Upload API (CVSS 5.1)
- [CVE-2026-61455](https://cve.now/CVE-2026-61455.md): Grav before 2.0.1 Decompression Bomb via ZipArchiver (CVSS 7.1)
- [CVE-2026-61450](https://cve.now/CVE-2026-61450.md): Grav before 2.0.2 Config Exfiltration via offsetGet Filter (CVSS 7.1)
- [CVE-2026-58656](https://cve.now/CVE-2026-58656.md): Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter (CVSS 8.7)
- [CVE-2026-42844](https://cve.now/CVE-2026-42844.md): Grav: Low-privileged API users can create super-admin accounts via blueprint-upload (CVSS 8.7)
- [CVE-2026-42843](https://cve.now/CVE-2026-42843.md): grav-plugin-api: Grav API Privilege Escalation to Super Admin (CVSS 8.8)
- [CVE-2026-44737](https://cve.now/CVE-2026-44737.md): grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/\[page\], parameter data\[header\]\[title\] (CVSS 6.2)
- [CVE-2026-44738](https://cve.now/CVE-2026-44738.md): Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() (CVSS 7.7)
- [CVE-2026-42845](https://cve.now/CVE-2026-42845.md): Grav: Anonymous Page Content Overwrite via Form File Upload filename Override (CVSS 7.7)
- [CVE-2026-42842](https://cve.now/CVE-2026-42842.md): grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel (CVSS 5.4)
- [CVE-2026-42613](https://cve.now/CVE-2026-42613.md): Grav: Privilege Escalation via Missing Server-Side Validation of groups/access (CVSS 9.4)
- [CVE-2026-42612](https://cve.now/CVE-2026-42612.md): Grav: Publisher-Level Stored XSS via Unquoted Event Attributes (CVSS 8.5)
- [CVE-2026-42611](https://cve.now/CVE-2026-42611.md): Grav: Stored XSS via Tag Injection (CVSS 8.9)
- [CVE-2026-42610](https://cve.now/CVE-2026-42610.md): Grav: Sensitive Information Disclosure via Accounts Service Bypass (CVSS 6.5)
- [CVE-2026-42609](https://cve.now/CVE-2026-42609.md): Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic (CVSS 8.1)
- [CVE-2026-42608](https://cve.now/CVE-2026-42608.md): Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. (CVSS 8.8)
- [CVE-2026-42607](https://cve.now/CVE-2026-42607.md): Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature (CVSS 9.1)
- [CVE-2026-42841](https://cve.now/CVE-2026-42841.md): Grav: Stored XSS via Markdown media attribute() action in Grav CMS (CVSS 6.9)
- [CVE-2020-36955](https://cve.now/CVE-2020-36955.md): Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting (CVSS 5.1)
- [CVE-2021-47812](https://cve.now/CVE-2021-47812.md): GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) (CVSS 9.3)
- [CVE-2025-66312](https://cve.now/CVE-2025-66312.md): Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/accounts/groups/\[group\]\` parameter \`data\[readableName\]\` (CVSS 6.2)
- [CVE-2025-66311](https://cve.now/CVE-2025-66311.md): Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/pages/\[page\]\` in Multiples parameters (CVSS 6.2)
- [CVE-2025-66310](https://cve.now/CVE-2025-66310.md): Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/pages/\[page\]\` parameter \`data\[header\]\[template\]\` in Advanced Tab (CVSS 6.2)
- [CVE-2025-66309](https://cve.now/CVE-2025-66309.md): Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/\[page\], parameter data\[header\]\[content\]\[items\], located in the "Blog Config" tab (CVSS 6.2)
- [CVE-2025-66308](https://cve.now/CVE-2025-66308.md): Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/config/site\` parameter \`data\[taxonomies\]\` (CVSS 6.8)
- [CVE-2025-66307](https://cve.now/CVE-2025-66307.md): Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure (CVSS 6.5)
- [CVE-2025-66306](https://cve.now/CVE-2025-66306.md): Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel (CVSS 4.3)
- [CVE-2025-66305](https://cve.now/CVE-2025-66305.md): Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter (CVSS 6.9)
- [CVE-2025-66304](https://cve.now/CVE-2025-66304.md): Grav Exposes Password Hashes Leading to privilege escalation (CVSS 6.2)
- [CVE-2025-66303](https://cve.now/CVE-2025-66303.md): Grav is vulnerable to a DOS on the admin panel (CVSS 4.9)
- [CVE-2025-66302](https://cve.now/CVE-2025-66302.md): Grav vulnerable to Path Traversal allowing server files backup (CVSS 6.8)
- [CVE-2025-66301](https://cve.now/CVE-2025-66301.md): Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions (CVSS 8.6)
- [CVE-2025-66300](https://cve.now/CVE-2025-66300.md): Grav is vulnerable to Arbitrary File Read (CVSS 8.5)
- [CVE-2025-66299](https://cve.now/CVE-2025-66299.md): Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS (CVSS 8.8)
- [CVE-2025-66298](https://cve.now/CVE-2025-66298.md): Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms (CVSS 7.7)
- [CVE-2025-66297](https://cve.now/CVE-2025-66297.md): Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection (CVSS 7.4)
- [CVE-2025-66296](https://cve.now/CVE-2025-66296.md): Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover (CVSS 8.8)
- [CVE-2025-66294](https://cve.now/CVE-2025-66294.md): Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass (CVSS 8.7)
- [CVE-2025-66295](https://cve.now/CVE-2025-66295.md): Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption (CVSS 8.8)
- [CVE-2024-34082](https://cve.now/CVE-2024-34082.md): Grav Arbitrary File Read to Account Takeover (CVSS 8.5)
- [CVE-2024-28119](https://cve.now/CVE-2024-28119.md): Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler (CVSS 8.8)
- [CVE-2024-28118](https://cve.now/CVE-2024-28118.md): Grav vulnerable to Server Side Template Injection (SSTI) (CVSS 8.8)
- [CVE-2024-28117](https://cve.now/CVE-2024-28117.md): Grav vulnerable to Server Side Template Injection (SSTI) (CVSS 8.8)
- [CVE-2024-28116](https://cve.now/CVE-2024-28116.md): Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass (CVSS 8.8)
- [CVE-2024-27921](https://cve.now/CVE-2024-27921.md): Grav File Upload Path Traversal vulnerability (CVSS 8.8)
- [CVE-2024-27923](https://cve.now/CVE-2024-27923.md): Remote Code Execution by uploading a phar file using frontmatter (CVSS 8.8)
- [CVE-2023-37897](https://cve.now/CVE-2023-37897.md): Server-side Template Injection (SSTI) in grav (CVSS 7.2)
- [CVE-2023-34452](https://cve.now/CVE-2023-34452.md): Grav vulnerable to Self Cross Site Scripting in /forgot\_password (CVSS 5.4)
- [CVE-2023-34448](https://cve.now/CVE-2023-34448.md): Grav Server-side Template Injection (SSTI) via Twig Default Filters (CVSS 8.8)
- [CVE-2023-34253](https://cve.now/CVE-2023-34253.md): Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass (CVSS 8.8)
- [CVE-2023-34252](https://cve.now/CVE-2023-34252.md): Grav Server-side Template Injection via Insufficient Validation in filterFilter (CVSS 8.8)
- [CVE-2023-34251](https://cve.now/CVE-2023-34251.md): Grav Server Side Template Injection vulnerability (CVSS 10.0)
- [CVE-2022-2073](https://cve.now/CVE-2022-2073.md): Code Injection in getgrav/grav (CVSS 9.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/getgrav
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.