Getgrav vulnerabilities
212 CVEs and advisories name Getgrav as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-58656Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter
- CVE-2026-42844Grav: Low-privileged API users can create super-admin accounts via blueprint-upload
- CVE-2026-42843grav-plugin-api: Grav API Privilege Escalation to Super Admin
- CVE-2026-44737grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]
- CVE-2026-44738Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
- CVE-2026-42845Grav: Anonymous Page Content Overwrite via Form File Upload filename Override
- CVE-2026-42842grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
- CVE-2026-42613Grav: Privilege Escalation via Missing Server-Side Validation of groups/access
- CVE-2026-42612Grav: Publisher-Level Stored XSS via Unquoted Event Attributes
- CVE-2026-42611Grav: Stored XSS via Tag Injection
- CVE-2026-42610Grav: Sensitive Information Disclosure via Accounts Service Bypass
- CVE-2026-42609Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
- CVE-2026-42608Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.
- CVE-2026-42607Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
- CVE-2026-42841Grav: Stored XSS via Markdown media attribute() action in Grav CMS
- CVE-2020-36955Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting
- CVE-2021-47812GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
- CVE-2025-66312Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
- CVE-2025-66311Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
- CVE-2025-66310Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
- CVE-2025-66309Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab
- CVE-2025-66308Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`
- CVE-2025-66307Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
- CVE-2025-66306Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
- CVE-2025-66305Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
- CVE-2025-66304Grav Exposes Password Hashes Leading to privilege escalation
- CVE-2025-66303Grav is vulnerable to a DOS on the admin panel
- CVE-2025-66302Grav vulnerable to Path Traversal allowing server files backup
- CVE-2025-66301Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
- CVE-2025-66300Grav is vulnerable to Arbitrary File Read