Getgrav vulnerabilities
212 CVEs and advisories name Getgrav as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-66299Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS
- CVE-2025-66298Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
- CVE-2025-66297Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
- CVE-2025-66296Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
- CVE-2025-66294Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
- CVE-2025-66295Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
- CVE-2024-34082Grav Arbitrary File Read to Account Takeover
- CVE-2024-28119Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler
- CVE-2024-28118Grav vulnerable to Server Side Template Injection (SSTI)
- CVE-2024-28117Grav vulnerable to Server Side Template Injection (SSTI)
- CVE-2024-28116Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
- CVE-2024-27921Grav File Upload Path Traversal vulnerability
- CVE-2024-27923Remote Code Execution by uploading a phar file using frontmatter
- CVE-2023-37897Server-side Template Injection (SSTI) in grav
- CVE-2023-34452Grav vulnerable to Self Cross Site Scripting in /forgot_password
- CVE-2023-34448Grav Server-side Template Injection (SSTI) via Twig Default Filters
- CVE-2023-34253Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass
- CVE-2023-34252Grav Server-side Template Injection via Insufficient Validation in filterFilter
- CVE-2023-34251Grav Server Side Template Injection vulnerability
- CVE-2022-2073Code Injection in getgrav/grav
- CVE-2022-1173stored xss in getgrav/grav
- CVE-2022-0970Cross-site Scripting (XSS) - Stored in getgrav/grav
- CVE-2022-0743Cross-site Scripting (XSS) - Stored in getgrav/grav
- CVE-2022-0268Cross-site Scripting (XSS) - Stored in getgrav/grav
- CVE-2021-3920Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin
- CVE-2021-3924Path Traversal in getgrav/grav
- CVE-2021-3904Cross-site Scripting (XSS) - Stored in getgrav/grav
- CVE-2021-3818Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
- CVE-2021-3799Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin
- CVE-2021-29440Twig allowing dangerous PHP functions by default