Getgrav Grav vulnerabilities

CVE-2026-42608 [CRITICAL] CWE-22 CVE-2026-42608: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability wi Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-c

CVE-2026-65008 [CRITICAL] CWE-94 CVE-2026-65008: Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticat

CVE-2025-50286 [HIGH] CWE-434 CVE-2025-50286: A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upl A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.

CVE-2025-66294 [HIGH] CWE-94 CVE-2025-66294: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) v Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak rege

CVE-2026-42607 [CRITICAL] CWE-94 CVE-2026-42607: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Onc

CVE-2021-29440 [HIGH] CWE-94 CVE-2021-29440: Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matte Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.

CVE-2025-66301 [CRITICAL] CWE-285 CVE-2025-66301: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][

CVE-2024-27921 [HIGH] CWE-22 CVE-2024-27921: Grav is an open-source, flat-file content management system. A file upload path traversal vulnerabil Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitr

CVE-2024-34082 [CRITICAL] CWE-269 CVE-2024-34082: Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page e Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromi

CVE-2021-47812 [CRITICAL] CWE-862 CVE-2021-47812: GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbit GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.

CVE-2026-72830 [HIGH] CWE-269 CVE-2026-72830: Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super- Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults api_key_scopes. An attacker holding a

CVE-2026-42613 [CRITICAL] CWE-20 CVE-2026-42613: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user c

CVE-2026-65608 [HIGH] CWE-470 CVE-2026-65608: Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthr

CVE-2026-75827 [HIGH] CWE-94 CVE-2026-75827: Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achievin

CVE-2026-61457 [HIGH] CWE-434 CVE-2026-61457: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass i The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shel

CVE-2026-85604 [HIGH] CWE-94 CVE-2026-85604: Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in t Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which perfo

CVE-2026-72827 [HIGH] CWE-1336 CVE-2026-72827: Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action param Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms ar

CVE-2026-72824 [HIGH] CWE-862 CVE-2026-72824: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page s

CVE-2026-58655 [HIGH] CWE-94 CVE-2026-58655: The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stor The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(

CVE-2020-11529 [MEDIUM] CWE-601 CVE-2020-11529: Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.