Getgrav vulnerabilities
212 CVEs and advisories name Getgrav as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-75828Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass
- CVE-2026-75827Grav before 2.0.15 Arbitrary File Write via error_log
- CVE-2026-75107Grav Form Plugin before 9.1.19 Stored XSS via Field Properties
- CVE-2026-74908Grav plugin-api before 1.0.15 Script Injection via SVG
- CVE-2026-74907Grav before 2.0.15 Path Traversal via plugin-asset-map.php
- CVE-2026-72833Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
- CVE-2026-72832Grav before 2.0.13 Stored XSS via quoted-attribute bypass
- CVE-2026-72831Grav through 2.0.11 Authentication Bypass via Flex Objects
- CVE-2026-72830Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
- CVE-2026-72829Grav before 1.0.13 API Key Scope Bypass via UsersController
- CVE-2026-72828Grav before 1.0.13 API Key Scope Bypass via InvitationsController
- CVE-2026-72827Grav CMS before 2.0.13 Remote Code Execution via Twig
- CVE-2026-72826Grav API Plugin before 1.0.13 Scope Bypass via createApiKey
- CVE-2026-72825Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController
- CVE-2026-72824Grav before 1.0.13 API Key Scope Bypass via PagesController
- CVE-2026-72823Grav before 1.0.13 API-key scope cap bypass via DemoController
- CVE-2026-72822Grav before 1.0.13 Authentication Bypass via disable2fa
- CVE-2026-72821Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle
- CVE-2026-72820Grav 2.0.11 Path Traversal via Backup Profile Configuration
- CVE-2026-72819Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
- CVE-2026-69089Grav CMS before 2.0.11 Path Traversal via watermark
- CVE-2026-69088Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint
- CVE-2026-69087Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig
- CVE-2026-66400Grav Login Plugin before 3.8.13 Insufficient Session Expiration
- CVE-2026-65897Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
- CVE-2026-65896Grav API Plugin before 1.0.10 Path Traversal via move
- CVE-2026-65895Grav API Plugin before 1.0.10 Broken Access Control
- CVE-2026-65608Grav before 2.0.9 Remote Code Execution via FlexDirectory
- CVE-2026-65603Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update
- CVE-2026-65008Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData