Getgrav vulnerabilities
212 CVEs and advisories name Getgrav as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56710Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
- CVE-2026-56709Grav before 3.9.2 Host Header Injection via sendInvitationEmail
- CVE-2026-56708Grav API Plugin before 1.0.16 SSRF via DNS Rebinding
- CVE-2026-56707Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode
- CVE-2026-64852Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
- CVE-2026-64850Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
- CVE-2026-64851Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers
- CVE-2026-63408Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
- CVE-2026-63407Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses
- CVE-2026-62671CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)
- CVE-2026-62673Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
- CVE-2026-62672Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
- CVE-2026-62667Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
- CVE-2026-62669Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
- CVE-2026-62666Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
- CVE-2026-62668Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
- CVE-2026-62670Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)
- CVE-2026-61842Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
- CVE-2026-61690Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
- CVE-2026-61607Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer
- CVE-2026-53654Grav: Unauthenticated open redirect via login twofa_cancel _redirect
- CVE-2026-75837Grav before 2.0.14 Privilege Escalation via Group Access Field
- CVE-2026-75836Grav API Plugin before 1.0.14 Missing Authorization
- CVE-2026-75835Grav API Plugin before 1.0.14 Missing Authorization
- CVE-2026-75834Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte
- CVE-2026-75833Grav API Plugin Open Redirect via Backslash Bypass
- CVE-2026-75832Grav API Plugin before 1.0.14 Authorization Bypass
- CVE-2026-75831Grav before 2.0.15 Stored XSS via audio/video source URL
- CVE-2026-75830grav-plugin-api before 1.0.15 Path Traversal via batchCopy
- CVE-2026-75829grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint