Getgrav vulnerabilities
212 CVEs and advisories name Getgrav as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-65007Grav before 1.0.8 Missing Authorization on API Key Generation
- CVE-2026-64628Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers
- CVE-2026-62387Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin
- CVE-2026-62386Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter
- CVE-2026-62237Grav < 2.0.4 ReDoS via regex_replace in Sandbox
- CVE-2026-62236grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret
- CVE-2026-62235Grav Flex-Objects < 1.4.3 Authorization Bypass via API
- CVE-2026-62234Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
- CVE-2026-62233grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
- CVE-2026-62232Grav < 2.0.4 2FA Bypass via Secret Regeneration
- CVE-2026-62231Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
- CVE-2026-62230Grav < 2.0.4 File Access Bypass via Case Variation
- CVE-2026-61873Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename
- CVE-2026-61457Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass
- CVE-2026-61453Grav before 2.0.1 XSS via Twig String Concatenation
- CVE-2026-61452Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens
- CVE-2026-61451Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url
- CVE-2026-61449Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
- CVE-2026-58655Grav Flex Objects - Server-Side Template Injection via Dynamic Titles
- CVE-2026-61454Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
- CVE-2026-59193Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
- CVE-2026-59190Grav Admin Plugin — IDOR Privilege Escalation via saveUser()
- CVE-2026-58493grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction
- CVE-2026-58492grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation
- CVE-2026-55890Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()
- CVE-2026-55885Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
- CVE-2026-53653Grav: Unauthenticated denial of service via unbounded image derivative dimensions
- CVE-2026-61456Grav before 1.0.3 Stored XSS via SVG Upload API
- CVE-2026-61455Grav before 2.0.1 Decompression Bomb via ZipArchiver
- CVE-2026-61450Grav before 2.0.2 Config Exfiltration via offsetGet Filter